diff --git a/docs/elasticsearch.md b/docs/elasticsearch.md index b3a666f8..592bda25 100644 --- a/docs/elasticsearch.md +++ b/docs/elasticsearch.md @@ -65,7 +65,7 @@ You can configure Elasticsearch by going to [Administration](administration.md) ## Parsing -Elasticsearch receives unparsed logs from [Logstash](logstash.md) or [Elastic Agent](elastic-agent.md). Elasticsearch then parses and stores those logs. Parsers are stored in `/opt/so/conf/elasticsearch/ingest/`. Custom ingest parsers can be placed in `/opt/so/saltstack/local/salt/elasticsearch/files/ingest/`. Files placed here are not detected by [Auto State Apply](salt.md#auto-state-apply), so to make these changes take effect, apply the Elasticsearch state to all nodes running Elasticsearch: +Elasticsearch receives unparsed logs from [Logstash](logstash.md) or [Elastic Agent](elastic-agent.md). Elasticsearch then parses and stores those logs. Parsers are stored in `/opt/so/conf/elasticsearch/ingest/`. Custom ingest parsers can be placed in `/opt/so/saltstack/local/salt/elasticsearch/files/ingest/`. [Auto State Apply](salt.md#auto-state-apply) picks these up within a few minutes. If you don't want to wait, apply the Elasticsearch state to all nodes running Elasticsearch: ``` diff --git a/docs/logstash.md b/docs/logstash.md index 3d7547fd..94a8459b 100644 --- a/docs/logstash.md +++ b/docs/logstash.md @@ -71,7 +71,7 @@ In [SOC](security-onion-console.md), navigate to [Administration](administration custom/myfile.conf ``` -The configuration will be applied at the next scheduled highstate (see [Highstate Interval](salt.md#highstate-interval)) or you can apply it immediately by clicking the `SYNCHRONIZE GRID` button under the `Options` menu. +[Auto State Apply](salt.md#auto-state-apply) will apply the configuration within a few minutes. If you don't want to wait, click the `SYNCHRONIZE GRID` button under the `Options` menu. You can monitor events flowing through the output by running the following command on the manager: @@ -82,7 +82,7 @@ curl -s localhost:9600/_node/stats | jq .pipelines.manager ## Modified Event Forwarding -To forward events to an external destination AFTER they have traversed the Logstash pipelines (NOT ingest node pipelines), perform the same steps as above but instead of adding the reference for your Logstash output to the `manager` pipeline add it to `search` pipeline instead. The configuration will be applied at the next scheduled highstate (see [Highstate Interval](salt.md#highstate-interval)) or immediately by clicking the `SYNCHRONIZE GRID` button under the `Options` menu. +To forward events to an external destination AFTER they have traversed the Logstash pipelines (NOT ingest node pipelines), perform the same steps as above but instead of adding the reference for your Logstash output to the `manager` pipeline add it to `search` pipeline instead. [Auto State Apply](salt.md#auto-state-apply) will apply the configuration within a few minutes. If you don't want to wait, click the `SYNCHRONIZE GRID` button under the `Options` menu. You can monitor events flowing through the output by running the following command on the search nodes: diff --git a/docs/rbac.md b/docs/rbac.md index fea1901c..0935f715 100644 --- a/docs/rbac.md +++ b/docs/rbac.md @@ -171,7 +171,7 @@ These steps will guide you through an example where we wish to introduce a new r sudo so-elasticsearch-query _security/privilege/kibana-.Kibana | jq '. | map_values(keys)' ``` -3. Role files are not detected by [Auto State Apply](salt.md#auto-state-apply), so this step is required. Run so-checkin from the manager: +3. [Auto State Apply](salt.md#auto-state-apply) picks up the new role file within a few minutes. If you don't want to wait, run so-checkin from the manager: ``` diff --git a/docs/release-notes.md b/docs/release-notes.md index a78510ef..e732ce9c 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -2,14 +2,6 @@ ### Known Issues -[Auto State Apply](salt.md#auto-state-apply) detects configuration changes saved in [Administration](administration.md) --> Configuration and rule updates on the manager node. Files that you create or edit directly under `/opt/so/saltstack/local/salt/` are not detected. After adding or changing any of the following, apply the relevant state from the manager or wait for the next scheduled highstate (see [Highstate Interval](salt.md#highstate-interval)): - -- [Zeek](zeek.md) intel in `/opt/so/saltstack/local/salt/zeek/policy/intel/` -- [Zeek](zeek.md) custom packages in `/opt/so/saltstack/local/salt/zeek/zkg/` -- [Elasticsearch](elasticsearch.md) custom ingest parsers in `/opt/so/saltstack/local/salt/elasticsearch/files/ingest/` -- [RBAC](rbac.md) custom Elastic stack role files in `/opt/so/saltstack/local/salt/elasticsearch/roles/` -- [Logstash](logstash.md) custom pipeline configuration files in `/opt/so/saltstack/local/salt/logstash/pipelines/config/custom/` - For all other known issues, please see . ### Release History diff --git a/docs/salt.md b/docs/salt.md index 3632043c..78289a77 100644 --- a/docs/salt.md +++ b/docs/salt.md @@ -43,6 +43,18 @@ sudo so-checkin When you save a configuration change in [Administration](administration.md) --> Configuration, or when rules are updated on the manager node, Security Onion detects the change and applies the affected state to only the nodes that need it. This typically happens within a few minutes instead of waiting for the next scheduled highstate. +Files that you create or edit by hand on the manager in any of the following directories are detected the same way: + +| Directory | What it holds | +|-----------|---------------| +| `/opt/so/saltstack/local/salt/zeek/policy/` | [Zeek](zeek.md) intel and custom policies | +| `/opt/so/saltstack/local/salt/zeek/zkg/` | [Zeek](zeek.md) custom packages | +| `/opt/so/saltstack/local/salt/elasticsearch/files/ingest/` | [Elasticsearch](elasticsearch.md) custom ingest parsers | +| `/opt/so/saltstack/local/salt/elasticsearch/roles/` | [RBAC](rbac.md) custom Elastic stack role files | +| `/opt/so/saltstack/local/salt/logstash/pipelines/config/custom/` | [Logstash](logstash.md) custom pipeline configuration files | + +Other files under `/opt/so/saltstack/local/salt/` are not watched and are picked up at the next scheduled highstate (see [Highstate Interval](#highstate-interval)). + Auto State Apply is configured at [Administration](administration.md) --> Configuration --> salt --> auto_apply: | Setting | Default | Description | @@ -93,4 +105,4 @@ The root cause of this error is a state trying to run on a minion when another s !!! NOTE - For more information about Salt, please see . \ No newline at end of file + For more information about Salt, please see . diff --git a/docs/zeek.md b/docs/zeek.md index b1db11ab..caef1b23 100644 --- a/docs/zeek.md +++ b/docs/zeek.md @@ -117,7 +117,7 @@ Please note that Zeek is very strict about the format of `intel.dat`. When editi The default `intel.dat` file follows these guidelines so you can reference it as an example of the proper format. -Intel files are not detected by [Auto State Apply](salt.md#auto-state-apply), so when finished editing `intel.dat`, run `sudo salt -C 'I@zeek:enabled:true' state.apply zeek` to sync `/opt/so/saltstack/local/salt/zeek/policy/intel/` to `/opt/so/conf/zeek/policy/intel/`. If you have a distributed deployment with separate sensor nodes and you don't run that command yourself, intel will sync to the sensor nodes at their next scheduled highstate (see [Highstate Interval](salt.md#highstate-interval)). +[Auto State Apply](salt.md#auto-state-apply) picks up changes to `intel.dat` within a few minutes. If you don't want to wait, run `sudo salt -C 'I@zeek:enabled:true' state.apply zeek` to sync `/opt/so/saltstack/local/salt/zeek/policy/intel/` to `/opt/so/conf/zeek/policy/intel/`. Either way, intel syncs to every node running Zeek, including separate sensor nodes in a distributed deployment. If you experience an error, or do not notice `/nsm/zeek/logs/current/intel.log` being generated, try having a look in `/nsm/zeek/logs/current/reporter.log` for clues. You may also want to restart Zeek after making changes by running `sudo so-zeek-restart`. @@ -137,7 +137,7 @@ The package directory should contain a valid Zeek package structure (including a zkg requires packages from git repos to be a clone of the repo. The working tree must be clean otherwise it will not install the package. `git status` will tell you if it is clean or not. -Packages are not detected by [Auto State Apply](salt.md#auto-state-apply), so after placing the package, run `sudo salt -C 'I@zeek:enabled:true' state.apply zeek` to sync the packages to the sensor nodes. The packages will be automatically installed with `zkg` each time the Zeek container starts. If you have a distributed deployment with separate sensor nodes and you don't run that command yourself, packages will sync to the sensor nodes at their next scheduled highstate (see [Highstate Interval](salt.md#highstate-interval)). +[Auto State Apply](salt.md#auto-state-apply) picks up new packages within a few minutes. If you don't want to wait, run `sudo salt -C 'I@zeek:enabled:true' state.apply zeek` to sync the packages to the sensor nodes. The packages will be automatically installed with `zkg` each time the Zeek container starts. You can verify that a custom package was installed by checking the Zeek container logs: