diff --git a/Vagrant/bootstrap.sh b/Vagrant/bootstrap.sh index 0bf69fb..ed2f1a7 100644 --- a/Vagrant/bootstrap.sh +++ b/Vagrant/bootstrap.sh @@ -115,6 +115,44 @@ install_splunk() { /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/punchcard-custom-visualization_130.tgz -auth 'admin:changeme' /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/sankey-diagram-custom-visualization_130.tgz -auth 'admin:changeme' /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/threathunting_134.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/base64_11.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/jellyfisher_010.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_611.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard_admin-master.zip -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard-master.zip -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/sa-investigator-for-enterprise-security_200.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-apache-web-server_100.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_310.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-iis_101.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_600.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_230.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_602.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-app-for-osquery_10.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-common-information-model-cim_4130.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-security-essentials_241.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-ta-for-suricata_233.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/ssl-certificate-checker_32.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/url-toolbox_16.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/website-monitoring_274.tgz -auth 'admin:changeme' + + # Install Splunk BOTsv2 FULL dataset + # More information https://github.com/splunk/botsv2 + + #echo "[$(date +%H:%M:%S)]: Downloading Splunk BOTSv2..." + #wget --progress=bar:force https://s3.amazonaws.com/botsdataset/botsv2/botsv2_data_set.tgz /opt/ + #echo "[$(date +%H:%M:%S)]: Download Complete." + #echo "[$(date +%H:%M:%S)]: Extracting to Splunk Apps directory" + #tar zxvf botsv2_data_set.tgz /opt/splunk/etc/apps + + # Install Splunk BOTsv2 Attack Only dataset + # More information https://github.com/splunk/botsv2 + + echo "[$(date +%H:%M:%S)]: Downloading Splunk BOTSv2 Attack Only Dataset..." + wget --progress=bar:force -P /opt/ https://s3.amazonaws.com/botsdataset/botsv2/botsv2_data_set_attack_only.tgz + echo "[$(date +%H:%M:%S)]: Download Complete." + echo "[$(date +%H:%M:%S)]: Extracting to Splunk Apps directory" + tar zxvf /opt/botsv2_data_set_attack_only.tgz -C /opt/splunk/etc/apps/ + # Add custom Macro definitions for ThreatHunting App cp /vagrant/resources/splunk_server/macros.conf /opt/splunk/etc/apps/ThreatHunting/default/macros.conf # Fix Windows TA macros diff --git a/Vagrant/resources/splunk_server/SA-ctf_scoreboard-master.zip b/Vagrant/resources/splunk_server/SA-ctf_scoreboard-master.zip new file mode 100644 index 0000000..4163eeb Binary files /dev/null and b/Vagrant/resources/splunk_server/SA-ctf_scoreboard-master.zip differ diff --git a/Vagrant/resources/splunk_server/SA-ctf_scoreboard_admin-master.zip b/Vagrant/resources/splunk_server/SA-ctf_scoreboard_admin-master.zip new file mode 100644 index 0000000..951da2d Binary files /dev/null and b/Vagrant/resources/splunk_server/SA-ctf_scoreboard_admin-master.zip differ diff --git a/Vagrant/resources/splunk_server/base64_11.tgz b/Vagrant/resources/splunk_server/base64_11.tgz new file mode 100644 index 0000000..60a28a6 Binary files /dev/null and b/Vagrant/resources/splunk_server/base64_11.tgz differ diff --git a/Vagrant/resources/splunk_server/jellyfisher_010.tgz b/Vagrant/resources/splunk_server/jellyfisher_010.tgz new file mode 100644 index 0000000..111fba2 Binary files /dev/null and b/Vagrant/resources/splunk_server/jellyfisher_010.tgz differ diff --git a/Vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_611.tgz b/Vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_611.tgz new file mode 100644 index 0000000..91de9a7 Binary files /dev/null and b/Vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_611.tgz differ diff --git a/Vagrant/resources/splunk_server/sa-investigator-for-enterprise-security_200.tgz b/Vagrant/resources/splunk_server/sa-investigator-for-enterprise-security_200.tgz new file mode 100644 index 0000000..27f049f Binary files /dev/null and b/Vagrant/resources/splunk_server/sa-investigator-for-enterprise-security_200.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-apache-web-server_100.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-apache-web-server_100.tgz new file mode 100644 index 0000000..2de977c Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-apache-web-server_100.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_310.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_310.tgz new file mode 100644 index 0000000..187b680 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_310.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-iis_101.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-iis_101.tgz new file mode 100644 index 0000000..25af5db Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-iis_101.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_600.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_600.tgz new file mode 100644 index 0000000..9a7a604 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_600.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_230.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_230.tgz new file mode 100644 index 0000000..a945375 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_230.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_602.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_602.tgz new file mode 100644 index 0000000..1414faa Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_602.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-app-for-osquery_10.tgz b/Vagrant/resources/splunk_server/splunk-app-for-osquery_10.tgz new file mode 100644 index 0000000..168ce3c Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-app-for-osquery_10.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-common-information-model-cim_4130.tgz b/Vagrant/resources/splunk_server/splunk-common-information-model-cim_4130.tgz new file mode 100644 index 0000000..a6a9a86 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-common-information-model-cim_4130.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-security-essentials_241.tgz b/Vagrant/resources/splunk_server/splunk-security-essentials_241.tgz new file mode 100644 index 0000000..f0786e3 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-security-essentials_241.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-ta-for-suricata_233.tgz b/Vagrant/resources/splunk_server/splunk-ta-for-suricata_233.tgz new file mode 100644 index 0000000..dba44a3 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-ta-for-suricata_233.tgz differ diff --git a/Vagrant/resources/splunk_server/ssl-certificate-checker_32.tgz b/Vagrant/resources/splunk_server/ssl-certificate-checker_32.tgz new file mode 100644 index 0000000..6dba832 Binary files /dev/null and b/Vagrant/resources/splunk_server/ssl-certificate-checker_32.tgz differ diff --git a/Vagrant/resources/splunk_server/url-toolbox_16.tgz b/Vagrant/resources/splunk_server/url-toolbox_16.tgz new file mode 100644 index 0000000..4d601de Binary files /dev/null and b/Vagrant/resources/splunk_server/url-toolbox_16.tgz differ diff --git a/Vagrant/resources/splunk_server/website-monitoring_274.tgz b/Vagrant/resources/splunk_server/website-monitoring_274.tgz new file mode 100644 index 0000000..b97e2c2 Binary files /dev/null and b/Vagrant/resources/splunk_server/website-monitoring_274.tgz differ