trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #564 from kernel-sanders/master

Browse Source 
Fix issues with fleet, ansible, and splunk (#563)
This commit is contained in:
Chris Long
2020-11-16 16:48:58 -08:00
committed by GitHub
parent cf336b578a 4d04dafdb6
commit 71bb917b12
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ESXi/ansible/roles/logger/tasks/main.yml
View File

@@ -384,7 +384,7 @@
/usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.enroll_secret' 'enrollmentsecret'
/usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_snapshot_event_type' 'true'
# Fleet 3.0 requires the "kind" to be "options" instead of "option"
sed -i 's/kind: option/kind: options/g' /tmp/options.yaml
# sed -i 's/kind: option/kind: options/g' /tmp/options.yaml # Not needed with change to fleetdm/fleet
fleetctl apply -f /tmp/options.yaml
# Use fleetctl to import YAML files
@@ -398,8 +398,8 @@
# Files must exist before splunk will add a monitor
touch /var/log/fleet/osquery_result
touch /var/log/fleet/osquery_status
/opt/splunk/bin/splunk add monitor "/var/log/fleet/osquery_result" -index osquery -sourcetype 'osquery:json' -auth 'admin:changeme'
/opt/splunk/bin/splunk add monitor "/var/log/fleet/osquery_status" -index osquery-status -sourcetype 'osquery:status' -auth 'admin:changeme'
/opt/splunk/bin/splunk add monitor "/var/log/fleet/osquery_result" -index osquery -sourcetype 'osquery:json' -auth 'admin:changeme' --accept-license --answer-yes --no-prompt
/opt/splunk/bin/splunk add monitor "/var/log/fleet/osquery_status" -index osquery-status -sourcetype 'osquery:status' -auth 'admin:changeme' --accept-license --answer-yes --no-prompt
register: fleet_osquery_config
failed_when: "'error' in fleet_osquery_config.stderr"
changed_when: "'Fleet login successful and context configured!' in fleet_osquery_config.stdout"