diff --git a/ESXi/ansible/inventory.yml b/ESXi/ansible/inventory.yml index 4165cf8..bc8ffb3 100644 --- a/ESXi/ansible/inventory.yml +++ b/ESXi/ansible/inventory.yml @@ -2,7 +2,7 @@ logger: hosts: - 192.168.3.151: + 192.168.3.158: ansible_user: vagrant ansible_password: vagrant ansible_port: 22 diff --git a/ESXi/ansible/roles/logger/tasks/main.yml b/ESXi/ansible/roles/logger/tasks/main.yml index d768a38..8fe5db5 100644 --- a/ESXi/ansible/roles/logger/tasks/main.yml +++ b/ESXi/ansible/roles/logger/tasks/main.yml @@ -204,51 +204,6 @@ /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/link-analysis-app-for-splunk_161.tgz -auth 'admin:changeme' /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/threathunting_141.tgz -auth 'admin:changeme' - # Uncomment the following block to install BOTSv2 - # Thanks to @MHaggis for this addition! - # It is recommended to only uncomment the attack-only dataset comment block. - # You may also link to the full dataset which is ~12GB if you prefer. - # More information on BOTSv2 can be found at https://github.com/splunk/botsv2 - - ### BOTSv2 COMMENT BLOCK BEGINS ### - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/base64_11.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/jellyfisher_010.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_611.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard_admin-master.zip -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard-master.zip -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/sa-investigator-for-enterprise-security_200.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-apache-web-server_100.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_310.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-iis_101.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_600.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_230.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_602.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-app-for-osquery_10.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-common-information-model-cim_4130.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-security-essentials_241.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-ta-for-suricata_233.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/ssl-certificate-checker_32.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/url-toolbox_16.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/website-monitoring_274.tgz -auth 'admin:changeme' - - ### UNCOMMENT THIS BLOCK FOR THE ATTACK-ONLY DATASET (Recommended) ### - # echo "[$(date +%H:%M:%S)]: Downloading Splunk BOTSv2 Attack Only Dataset..." - # wget --progress=bar:force -P /opt/ https://s3.amazonaws.com/botsdataset/botsv2/botsv2_data_set_attack_only.tgz - # echo "[$(date +%H:%M:%S)]: Download Complete." - # echo "[$(date +%H:%M:%S)]: Extracting to Splunk Apps directory" - # tar zxvf /opt/botsv2_data_set_attack_only.tgz -C /opt/splunk/etc/apps/ - ### ATTACK-ONLY COMMENT BLOCK ENDS ### - - ### UNCOMMENT THIS BLOCK FOR THE FULL 12GB DATASET (Not recommended) ### - # echo "[$(date +%H:%M:%S)]: Downloading Splunk BOTSv2..." - # wget --progress=bar:force https://s3.amazonaws.com/botsdataset/botsv2/botsv2_data_set.tgz /opt/ - # echo "[$(date +%H:%M:%S)]: Download Complete." - # echo "[$(date +%H:%M:%S)]: Extracting to Splunk Apps directory" - # tar zxvf botsv2_data_set.tgz /opt/splunk/etc/apps - ### FULL DATASET COMMENT BLOCK ENDS ### - - ### BOTSv2 COMMENT BLOCK ENDS ### - # Add custom Macro definitions for ThreatHunting App cp /vagrant/resources/splunk_server/macros.conf /opt/splunk/etc/apps/ThreatHunting/default/macros.conf # Fix Windows TA macros @@ -273,33 +228,29 @@ mkdir -p /opt/splunk/etc/users/admin/search/local echo -e "[search-tour]\nviewed = 1" >/opt/splunk/etc/system/local/ui-tour.conf # Source: https://answers.splunk.com/answers/660728/how-to-disable-the-modal-pop-up-help-us-to-improve.html + if [ ! -d "/opt/splunk/etc/users/admin/user-prefs/local" ]; then + mkdir -p "/opt/splunk/etc/users/admin/user-prefs/local" + fi echo '[general] - render_version_messages = 0 - hideInstrumentationOptInModal = 1 - dismissedInstrumentationOptInVersion = 1 - [general_default] - hideInstrumentationOptInModal = 1 - showWhatsNew = 0 - notification_python_3_impact = false' >/opt/splunk/etc/system/local/user-prefs.conf - echo '[general] - render_version_messages = 0 - hideInstrumentationOptInModal = 1 - dismissedInstrumentationOptInVersion = 1 - [general_default] - hideInstrumentationOptInModal = 1 - showWhatsNew = 0 - notification_python_3_impact = false' >/opt/splunk/etc/apps/user-prefs/local/user-prefs.conf + render_version_messages = 1 + dismissedInstrumentationOptInVersion = 4 + notification_python_3_impact = false + display.page.home.dashboardId = /servicesNS/nobody/search/data/ui/views/logger_dashboard' > /opt/splunk/etc/users/admin/user-prefs/local/user-prefs.conf # Disable the instrumentation popup echo -e "showOptInModal = 0\noptInVersionAcknowledged = 4" >>/opt/splunk/etc/apps/splunk_instrumentation/local/telemetry.conf - # Enable SSL Login for Splunk echo -e "[settings]\nenableSplunkWebSSL = true" >/opt/splunk/etc/system/local/web.conf + # Copy over the Logger Dashboard + if [ ! -d "/opt/splunk/etc/apps/search/local/data/ui/views" ]; then + mkdir -p "/opt/splunk/etc/apps/search/local/data/ui/views" + fi + cp /vagrant/resources/splunk_server/logger_dashboard.xml /opt/splunk/etc/apps/search/local/data/ui/views || echo "Unable to find dashboard" # Reboot Splunk to make changes take effect - /opt/splunk/bin/splunk restart - /opt/splunk/bin/splunk enable boot-start - # Generate the ASN lookup table - /opt/splunk/bin/splunk search "|asngen | outputlookup asn" -auth 'admin:changeme' - fi + /opt/splunk/bin/splunk restart + /opt/splunk/bin/splunk enable boot-start + # Generate the ASN lookup table + /opt/splunk/bin/splunk search "|asngen | outputlookup asn" -auth 'admin:changeme' + fi register: install_splunk changed_when: "'The Splunk web interface is at https://logger:8000' in install_splunk.stdout" @@ -344,7 +295,6 @@ fi register: download_palantir_osquery failed_when: "'error' in download_palantir_osquery.stderr" - - name: Import osquery Config into Fleet args: @@ -367,13 +317,11 @@ sed -i 's/interval: 3600/interval: 180/g' osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/MacOS/osquery.yaml sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml - # These can be removed after this PR is merged: https://github.com/palantir/osquery-configuration/pull/14 - sed -i "s/labels: null/labels:\n - MS Windows/g" osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml - sed -i "s/labels: null/labels:\n - MS Windows/g" osquery-configuration/Fleet/Endpoints/packs/windows-application-security.yaml - sed -i "s/labels: null/labels:\n - MS Windows/g" osquery-configuration/Fleet/Endpoints/packs/windows-compliance.yaml - sed -i "s/labels: null/labels:\n - MS Windows/g" osquery-configuration/Fleet/Endpoints/packs/windows-registry-monitoring.yaml - sed -i "s/labels: null/labels:\n - MS Windows\n - macOS/g" osquery-configuration/Fleet/Endpoints/packs/performance-metrics.yaml - sed -i "s/labels: null/labels:\n - MS Windows\n - macOS/g" osquery-configuration/Fleet/Endpoints/packs/security-tooling-checks.yaml + + # Dont log osquery INFO messages + fleetctl get options > /tmp/options.yaml + /usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_min_status' '1' + fleetctl apply -f /tmp/options.yaml # Use fleetctl to import YAML files fleetctl apply -f osquery-configuration/Fleet/Endpoints/MacOS/osquery.yaml diff --git a/ESXi/main.tf b/ESXi/main.tf index 8839b19..ca911ab 100644 --- a/ESXi/main.tf +++ b/ESXi/main.tf @@ -30,9 +30,8 @@ resource "esxi_guest" "logger" { provisioner "remote-exec" { inline = [ - "sudo ifconfig up eth1 | echo 'eth1 up'", + "sudo ifconfig up eth1 || echo 'eth1 up'", "sudo ifconfig up eth2 || echo 'eth2 up'", - "sudo dhclient -v eth1 || echo 'eth1 dhcp'", "sudo route add default gw 192.168.76.1 || echo 'route exists'" ] diff --git a/Vagrant/bootstrap.sh b/Vagrant/bootstrap.sh index 49a8820..9fd6aa4 100644 --- a/Vagrant/bootstrap.sh +++ b/Vagrant/bootstrap.sh @@ -142,98 +142,6 @@ install_splunk() { /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/link-analysis-app-for-splunk_161.tgz -auth 'admin:changeme' /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/threathunting_141.tgz -auth 'admin:changeme' - # Uncomment the following block to install BOTSv2 - # Thanks to @MHaggis for this addition! - # It is recommended to only uncomment the attack-only dataset comment block. - # You may also link to the full dataset which is ~12GB if you prefer. - # More information on BOTSv2 can be found at https://github.com/splunk/botsv2 - - ### BOTSv2 COMMENT BLOCK BEGINS ### - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/base64_11.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/jellyfisher_010.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_620.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard_admin-master.zip -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard-master.zip -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/sa-investigator-for-enterprise-security_200.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-apache-web-server_100.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_310.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-iis_101.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_700.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_230.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_701.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/osquery-app-for-splunk_060.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-common-information-model-cim_4150.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-security-essentials_306.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-ta-for-suricata_233.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/ssl-certificate-checker_32.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/url-toolbox_18.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/website-monitoring_274.tgz -auth 'admin:changeme' - - ### UNCOMMENT THIS BLOCK FOR THE ATTACK-ONLY DATASET (Recommended) ### - # echo "[$(date +%H:%M:%S)]: Downloading Splunk BOTSv2 Attack Only Dataset..." - # wget --progress=bar:force -P /opt/ https://s3.amazonaws.com/botsdataset/botsv2/botsv2_data_set_attack_only.tgz - # echo "[$(date +%H:%M:%S)]: Download Complete." - # echo "[$(date +%H:%M:%S)]: Extracting to Splunk Apps directory" - # tar zxvf /opt/botsv2_data_set_attack_only.tgz -C /opt/splunk/etc/apps/ - ### ATTACK-ONLY COMMENT BLOCK ENDS ### - - ### UNCOMMENT THIS BLOCK FOR THE FULL 12GB DATASET (Not recommended) ### - # echo "[$(date +%H:%M:%S)]: Downloading Splunk BOTSv2..." - # wget --progress=bar:force https://s3.amazonaws.com/botsdataset/botsv2/botsv2_data_set.tgz /opt/ - # echo "[$(date +%H:%M:%S)]: Download Complete." - # echo "[$(date +%H:%M:%S)]: Extracting to Splunk Apps directory" - # tar zxvf botsv2_data_set.tgz /opt/splunk/etc/apps - ### FULL DATASET COMMENT BLOCK ENDS ### - - ### BOTSv2 COMMENT BLOCK ENDS ### - - # Uncomment the following block to install BOTSv3 - # Thanks to @MHaggis for this addition! - # More information on BOTSv3 can be found at https://github.com/splunk/botsv3 - - ### BOTSv3 COMMENT BLOCK BEGINS ### - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/base64_11.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/jellyfisher_010.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_620.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard_admin-master.zip -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard-master.zip -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/sa-investigator-for-enterprise-security_200.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-apache-web-server_100.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-iis_101.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-ta-for-suricata_233.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/ssl-certificate-checker_32.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/website-monitoring_274.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/amazon-guardduty-add-on-for-splunk_104.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/cisco-anyconnect-network-visibility-module-nvm-app-for-splunk_20187.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/code42-for-splunk_3012.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/decrypt_20.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/microsoft-365-app-for-splunk_301.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/microsoft-azure-add-on-for-splunk_202.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/osquery-app-for-splunk_060.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-amazon-web-services_500.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-cisco-asa_340.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_401.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-office-365_201.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-sysmon_1062.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_700.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_301.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-tenable_514.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_701.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-common-information-model-cim_4150.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-es-content-update_1052.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-security-essentials_306.tgz -auth 'admin:changeme' - ## /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-stream_720.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/ta-for-code42-app-for-splunk_3012.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/url-toolbox_18.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/virustotal-workflow-actions-for-splunk_020.tgz -auth 'admin:changeme' - - ### UNCOMMENT THIS BLOCK FOR BOTSv3 DATASET ### - # echo "[$(date +%H:%M:%S)]: Downloading Splunk BOTSv3 Attack Only Dataset..." - # wget --progress=bar:force -P /opt/ https://botsdataset.s3.amazonaws.com/botsv3/botsv3_data_set.tgz - # echo "[$(date +%H:%M:%S)]: Download Complete." - # echo "[$(date +%H:%M:%S)]: Extracting to Splunk Apps directory" - # tar zxvf /opt/botsv3_data_set.tgz -C /opt/splunk/etc/apps/ - ### BOTSv3 COMMENT BLOCK ENDS ### - # Add custom Macro definitions for ThreatHunting App cp /vagrant/resources/splunk_server/macros.conf /opt/splunk/etc/apps/ThreatHunting/default/macros.conf # Fix Windows TA macros @@ -258,27 +166,23 @@ install_splunk() { mkdir -p /opt/splunk/etc/users/admin/search/local echo -e "[search-tour]\nviewed = 1" >/opt/splunk/etc/system/local/ui-tour.conf # Source: https://answers.splunk.com/answers/660728/how-to-disable-the-modal-pop-up-help-us-to-improve.html + if [ ! -d "/opt/splunk/etc/users/admin/user-prefs/local" ]; then + mkdir -p "/opt/splunk/etc/users/admin/user-prefs/local" + fi echo '[general] -render_version_messages = 0 -hideInstrumentationOptInModal = 1 -dismissedInstrumentationOptInVersion = 1 -[general_default] -hideInstrumentationOptInModal = 1 -showWhatsNew = 0 -notification_python_3_impact = false' >/opt/splunk/etc/system/local/user-prefs.conf - echo '[general] -render_version_messages = 0 -hideInstrumentationOptInModal = 1 -dismissedInstrumentationOptInVersion = 1 -[general_default] -hideInstrumentationOptInModal = 1 -showWhatsNew = 0 -notification_python_3_impact = false' >/opt/splunk/etc/apps/user-prefs/local/user-prefs.conf +render_version_messages = 1 +dismissedInstrumentationOptInVersion = 4 +notification_python_3_impact = false +display.page.home.dashboardId = /servicesNS/nobody/search/data/ui/views/logger_dashboard' > /opt/splunk/etc/users/admin/user-prefs/local/user-prefs.conf # Disable the instrumentation popup echo -e "showOptInModal = 0\noptInVersionAcknowledged = 4" >>/opt/splunk/etc/apps/splunk_instrumentation/local/telemetry.conf - # Enable SSL Login for Splunk echo -e "[settings]\nenableSplunkWebSSL = true" >/opt/splunk/etc/system/local/web.conf + # Copy over the Logger Dashboard + if [ ! -d "/opt/splunk/etc/apps/search/local/data/ui/views" ]; then + mkdir -p "/opt/splunk/etc/apps/search/local/data/ui/views" + fi + cp /vagrant/resources/splunk_server/logger_dashboard.xml /opt/splunk/etc/apps/search/local/data/ui/views || echo "Unable to find dashboard" # Reboot Splunk to make changes take effect /opt/splunk/bin/splunk restart /opt/splunk/bin/splunk enable boot-start @@ -335,13 +239,11 @@ import_osquery_config_into_fleet() { sed -i 's/interval: 3600/interval: 180/g' osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/MacOS/osquery.yaml sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml - # These can be removed after this PR is merged: https://github.com/palantir/osquery-configuration/pull/14 - sed -i "s/labels: null/labels:\n - MS Windows/g" osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml - sed -i "s/labels: null/labels:\n - MS Windows/g" osquery-configuration/Fleet/Endpoints/packs/windows-application-security.yaml - sed -i "s/labels: null/labels:\n - MS Windows/g" osquery-configuration/Fleet/Endpoints/packs/windows-compliance.yaml - sed -i "s/labels: null/labels:\n - MS Windows/g" osquery-configuration/Fleet/Endpoints/packs/windows-registry-monitoring.yaml - sed -i "s/labels: null/labels:\n - MS Windows\n - macOS/g" osquery-configuration/Fleet/Endpoints/packs/performance-metrics.yaml - sed -i "s/labels: null/labels:\n - MS Windows\n - macOS/g" osquery-configuration/Fleet/Endpoints/packs/security-tooling-checks.yaml + + # Don't log osquery INFO messages + fleetctl get options > /tmp/options.yaml + /usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_min_status' '1' + fleetctl apply -f /tmp/options.yaml # Use fleetctl to import YAML files fleetctl apply -f osquery-configuration/Fleet/Endpoints/MacOS/osquery.yaml diff --git a/Vagrant/resources/splunk_server/logger_dashboard.xml b/Vagrant/resources/splunk_server/logger_dashboard.xml new file mode 100644 index 0000000..76eaab3 --- /dev/null +++ b/Vagrant/resources/splunk_server/logger_dashboard.xml @@ -0,0 +1,164 @@ + + + + + Events by Index per Hour + + + | tstats count where index=* by index, _time span=4h prestats=t | timechart span=4h count by index + -7d@h + now + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Top Suricata Network Alerts + + + index=suricata | stats values(src_ip) count by alert.signature, alert.signature_id + -24h@h + now + 1 + + + + + + + + + +
+ + + Zeek Network Traffic by Type + + + index=zeek | stats count by _time, tag::eventtype | timechart span=1h count by tag::eventtype + -24h@h + now + + + + + + + + + + Windows Events by Host + + + | tstats count where index=wineventlog by host, _time span=1h prestats=t | timechart span=1h count by host + -24h@h + now + + + + + + + + osquery Events by Host + + + | tstats count where index=osquery by host, _time span=1h prestats=t | timechart span=1h count by host + -24h@h + now + + + + + + + + Powershell Event Preview + + + index=powershell | table _time, host, _raw, sourcetype + -24h@h + now + + + +
+ + + + + License Usage + + + | rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "Used"=round(used_bytes/1024/1024/1024, 3) | eval "Quota"=round(quota/1024/1024/1024, 3) | fields Pool "Used" "Quota" + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Vagrant/resources/splunk_server/props.conf b/Vagrant/resources/splunk_server/props.conf index 199cb78..53239a7 100644 --- a/Vagrant/resources/splunk_server/props.conf +++ b/Vagrant/resources/splunk_server/props.conf @@ -12,3 +12,11 @@ TIME_PREFIX = Start time:\s category = Custom pulldown_type = true TRUNCATE = 0 + +[osquery:json] +TRANSFORMS-osquery_host = osquery_hostidentifier_as_host +TRANSFORMS-null = setnull +TIME_PREFIX = \"unixTime\"\: +MAX_TIMESTAMP_LOOKAHEAD = 500 +TIME_FORMAT = %s +TRUNCATE = 0 \ No newline at end of file diff --git a/Vagrant/resources/splunk_server/transforms.conf b/Vagrant/resources/splunk_server/transforms.conf index 6d0d43f..89249ce 100644 --- a/Vagrant/resources/splunk_server/transforms.conf +++ b/Vagrant/resources/splunk_server/transforms.conf @@ -8,3 +8,13 @@ FORMAT = host::$1 DEST_KEY = MetaData:Host REGEX = (?m)ComputerName=(.+) FORMAT = host::$1 + +[osquery_hostidentifier_as_host] +DEST_KEY = MetaData:Host +REGEX = hostIdentifier\"\:\"([^\"]+)\" +FORMAT = host::$1 + +[setnull] +REGEX = Error\scasting +DEST_KEY = queue +FORMAT = nullQueue \ No newline at end of file diff --git a/Vagrant/scripts/install-botsv2.sh b/Vagrant/scripts/install-botsv2.sh new file mode 100644 index 0000000..d0a90c6 --- /dev/null +++ b/Vagrant/scripts/install-botsv2.sh @@ -0,0 +1,43 @@ +#! /bin/bash + + # Thanks to @MHaggis for this addition! + # It is recommended to only uncomment the attack-only dataset comment block. + # You may also link to the full dataset which is ~12GB if you prefer. + # More information on BOTSv2 can be found at https://github.com/splunk/botsv2 + + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/base64_11.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/jellyfisher_010.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_620.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard_admin-master.zip -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard-master.zip -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/sa-investigator-for-enterprise-security_200.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-apache-web-server_100.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_310.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-iis_101.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_700.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_230.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_701.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/osquery-app-for-splunk_060.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-common-information-model-cim_4150.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-security-essentials_306.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-ta-for-suricata_233.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/ssl-certificate-checker_32.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/url-toolbox_18.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/website-monitoring_274.tgz -auth 'admin:changeme' + + echo "[$(date +%H:%M:%S)]: Downloading Splunk BOTSv2 Attack Only Dataset..." + wget --progress=bar:force -P /opt/ https://s3.amazonaws.com/botsdataset/botsv2/botsv2_data_set_attack_only.tgz + echo "[$(date +%H:%M:%S)]: Download Complete." + echo "[$(date +%H:%M:%S)]: Extracting to Splunk Apps directory" + tar zxvf /opt/botsv2_data_set_attack_only.tgz -C /opt/splunk/etc/apps/ + + + ## UNCOMMENT THIS BLOCK FOR THE FULL 12GB DATASET (Not recommended) ### + # echo "[$(date +%H:%M:%S)]: Downloading Splunk BOTSv2..." + # wget --progress=bar:force https://s3.amazonaws.com/botsdataset/botsv2/botsv2_data_set.tgz /opt/ + # echo "[$(date +%H:%M:%S)]: Download Complete." + # echo "[$(date +%H:%M:%S)]: Extracting to Splunk Apps directory" + # tar zxvf botsv2_data_set.tgz /opt/splunk/etc/apps + ## FULL DATASET COMMENT BLOCK ENDS ### + +echo "BOTSv2 Installation complete!" \ No newline at end of file diff --git a/Vagrant/scripts/install-botsv3.sh b/Vagrant/scripts/install-botsv3.sh new file mode 100644 index 0000000..474b3b6 --- /dev/null +++ b/Vagrant/scripts/install-botsv3.sh @@ -0,0 +1,46 @@ +#! /bin/bash + +#Thanks to @MHaggis for this addition! +#More information on BOTSv3 can be found at https://github.com/splunk/botsv3 + +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/base64_11.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/jellyfisher_010.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_620.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard_admin-master.zip -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard-master.zip -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/sa-investigator-for-enterprise-security_200.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-apache-web-server_100.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-iis_101.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-ta-for-suricata_233.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/ssl-certificate-checker_32.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/website-monitoring_274.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/amazon-guardduty-add-on-for-splunk_104.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/cisco-anyconnect-network-visibility-module-nvm-app-for-splunk_20187.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/code42-for-splunk_3012.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/decrypt_20.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/microsoft-365-app-for-splunk_301.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/microsoft-azure-add-on-for-splunk_202.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/osquery-app-for-splunk_060.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-amazon-web-services_500.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-cisco-asa_340.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_401.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-office-365_201.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-sysmon_1062.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_700.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_301.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-tenable_514.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_701.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-common-information-model-cim_4150.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-es-content-update_1052.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-security-essentials_306.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-stream_720.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/ta-for-code42-app-for-splunk_3012.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/url-toolbox_18.tgz -auth 'admin:changeme' +/opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/virustotal-workflow-actions-for-splunk_020.tgz -auth 'admin:changeme' + +echo "[$(date +%H:%M:%S)]: Downloading Splunk BOTSv3 Attack Only Dataset..." +wget --progress=bar:force -P /opt/ https://botsdataset.s3.amazonaws.com/botsv3/botsv3_data_set.tgz +echo "[$(date +%H:%M:%S)]: Download Complete." +echo "[$(date +%H:%M:%S)]: Extracting to Splunk Apps directory" +tar zxvf /opt/botsv3_data_set.tgz -C /opt/splunk/etc/apps/ + +echo "BOTSv3 Installation complete!" \ No newline at end of file