Skip to content

Commit

Permalink
Functional build
Browse files Browse the repository at this point in the history
  • Loading branch information
Ryan Faircloth committed Jun 28, 2019
1 parent b8363c6 commit c59c14e
Show file tree
Hide file tree
Showing 17 changed files with 981 additions and 1 deletion.
16 changes: 15 additions & 1 deletion package/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,4 +60,18 @@ RUN cd /tmp ;\
rh-python36 rh-python36-python-tools libcurl ivykis -y;\
echo source scl_source enable rh-python36 >>/etc/profile.d/enablepython36.sh

COPY --from=0 /opt/syslog-ng /opt/syslog-ng
COPY --from=0 /opt/syslog-ng /opt/syslog-ng
COPY scripts/* /opt/syslog-ng/sbin/
COPY etc/* /opt/syslog-ng/etc
COPY sbin/* /sbin/

RUN /opt/syslog-ng/sbin/syslog-ng -t

ENV DEBCONF_NONINTERACTIVE_SEEN=true
ENV SPLUNK_CONNECT_METHOD=uf

EXPOSE 514
EXPOSE 601/tcp
EXPOSE 6514/tcp

ENTRYPOINT ["/sbin/entrypoint.sh", "--"]
96 changes: 96 additions & 0 deletions package/etc/conf.d/blocks/b_parsers.conf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,96 @@
# ===============================================================================================
# ForcePoint (Websense)
# ===============================================================================================

# ===============================================================================================
# Log Format:
# <159>Dec 19 10:48:57 EST 10.203.28.21 vendor=Websense product=Security product_version=7.7.0 action=permitted severity=1 category=153 user=- src_host=10.64.134.74 src_port=62189 dst_host=mail.google.com dst_ip=74.125.224.53 dst_port=443 bytes_out=197 bytes_in=76 http_response=200 http_method=CONNECT http_content_type=- http_user_agent=Mozilla/5.0_(Windows;_U;_Windows_NT_6.1;_enUS;_rv:1.9.2.23)_Gecko/20110920_Firefox/3.6.23 http_proxy_status_code=200 reason=- disposition=1034 policy=- role=8 duration=0 url=https://mail.google.com
#
# Primary reason for non-compliance: %Z (timesone mnemonic) appended after date/time
# ===============================================================================================

block parser p_websense-parser(prefix(".websense.")) {
channel {
rewrite {
# normal BSD timestamp, plus a timezone code. Remove the
# timezone information for now.
subst('([A-Za-z]{3} [0-9 ]\d \d{2}:\d{2}:\d{2}) [A-Z]{3,4}' "$1 " flags(global) value("MSG"));

# add a $PROGRAM field, so that syslog-parser() would extract
# that properly
subst('(vendor=Websense)' "Websense: $1" flags(global) value("MSG"));
};
parser {
# by this time this message is a properly formatted syslog message
syslog-parser(time-zone(`default-timezone`));
# syslog-parser();

# extract name-value pairs.
# kv-parser(prefix("`prefix`"));
};
};
};

block parser p_RFC5424-lite(prefix(".rfc5424-lite.")) {
channel {
rewrite {
# Remove Version Identifier
subst('(<\d+>)\d+' "$1" value("MSG"));

};
parser {
# by this time this message will parse with the BSD 3164 parser
syslog-parser(time-zone(`default-timezone`));
# syslog-parser();

# extract name-value pairs.
# kv-parser(prefix("`prefix`"));
};
};
};

block parser p_test-parser(prefix(".testparse.")) {
channel {
rewrite {
# Put your rewrite rule here;use "MSG" as no-parse() puts entire payload there
# subst('(>.{12})\s' "${1}T" value("MSG"));
};
parser {
# Don't initially parse so full output can be seen
# syslog-parser(time-zone(`default-timezone`) flags(syslog-protocol));
# syslog-parser();
# syslog-parser(time-zone(`default-timezone`));
# date-parser(format("%Y-%m-%d %H:%M:%S") template("$(substr ${MESSAGE} 0 19)") time-zone(`default-timezone`));
};
};
};

block parser p_add_context_data(data-source("unassigned")) {
add-contextual-data(selector(`data-source`), database("sourcetype-db.csv"), default-selector("unknown"));
};

block rewrite r_set_splunk(sourcetype(`splunk-sourcetype`)
index(`splunk-index`)
template(`splunk-default-template`)
token(`splunk-hec-token`)
url(`splunk-hec-url`)
brokers(`splunk-kafka-brokers`)
topic(`splunk-kafka-topic`)
vendor("unassigned")
category("")
filename("messages")
) {
set("`index`", value(".splunk.index"));
set("`sourcetype`", value(".splunk.sourcetype"));
set("`template`", value(".splunk.template"));
set('`url`', value(".splunk.url"));
set("`token`", value(".splunk.token"));
set("`brokers`", value(".splunk.brokers"));
set("`topic`", value(".splunk.topic"));
set("`vendor`", value(".splunk.vendor"));
set("`category`", value(".splunk.category"));
set("`filename`", value(".splunk.filename"));
set($FACILITY, value("fields.facility"));
set($LEVEL, value("fields.severity"));
set($LOGHOST, value("fields.syslog-server"));
};
81 changes: 81 additions & 0 deletions package/etc/conf.d/blocks/b_sources.conf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,81 @@
# ===============================================================================================
# Source block for data arriving on unique ports; parsing defaults to "no-parse"
# ===============================================================================================

block source s_unique-ports(udp_port() tcp_port() flags("no-parse")) {
`splunk-udp-driver` (
transport("udp")
port(`udp_port`)
ip-protocol(`ip-version`)
# hook-commands(
# setup("firewall-cmd --permanent --add-port=514/udp")
# teardown("firewall-cmd --permanent --remove-port=514/udp")
# )
so-rcvbuf(`splunk-rcvbuf`)
keep-hostname(yes)
keep-timestamp(yes)
use-dns(no)
use-fqdn(no)
chain-hostnames(off)
flags(`flags`)
);

`splunk-tcp-driver` (
transport("tcp")
port(`tcp_port`)
ip-protocol(`ip-version`)
# hook-commands(
# setup("firewall-cmd --permanent --add-port=514/tcp")
# teardown("firewall-cmd --permanent --remove-port=514/tcp")
# )
max-connections(`splunk-max-connections`)
log-iw-size(`splunk-window-size`)
log-fetch-limit(`splunk-fetch-limit`)
keep-hostname(yes)
keep-timestamp(yes)
use-dns(no)
use-fqdn(no)
chain-hostnames(off)
flags(`flags`)
);
};

block source s_unique-udp-port(udp_port() flags("no-parse")) {
`splunk-udp-driver` (
transport("udp")
port(`udp_port`)
ip-protocol(`ip-version`)
# hook-commands(
# setup("firewall-cmd --permanent --add-port=514/udp")
# teardown("firewall-cmd --permanent --remove-port=514/udp")
# )
so-rcvbuf(`splunk-rcvbuf`)
keep-hostname(yes)
keep-timestamp(yes)
use-dns(no)
use-fqdn(no)
chain-hostnames(off)
flags(`flags`)
);
};

block source s_unique-tcp-port(tcp_port() flags("no-parse")) {
`splunk-tcp-driver` (
transport("tcp")
port(`tcp_port`)
ip-protocol(`ip-version`)
# hook-commands(
# setup("firewall-cmd --permanent --add-port=514/tcp")
# teardown("firewall-cmd --permanent --remove-port=514/tcp")
# )
max-connections(`splunk-max-connections`)
log-iw-size(`splunk-window-size`)
log-fetch-limit(`splunk-fetch-limit`)
keep-hostname(yes)
keep-timestamp(yes)
use-dns(no)
use-fqdn(no)
chain-hostnames(off)
flags(`flags`)
);
};
23 changes: 23 additions & 0 deletions package/etc/conf.d/destinations/d_UF.conf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
# ===============================================================================================
# File destination (for use with the Splunk Universal Forwarder)
# ===============================================================================================

# ===============================================================================================
# Logfile Local Defaults:
# vendor: unassigned
# message: suffix for log file names: "messages"
# ===============================================================================================

destination d_splunk_logfile {
file("`splunk-log-root`/${.splunk.category}/$(lowercase \"${LOGHOST}\")/${.splunk.vendor}/$(lowercase \"${HOST}\")/${YEAR}.${MONTH}.${DAY}.${HOUR}-${.splunk.filename}"
template(`splunk-default-template`)
flush-lines(0)
create-dirs(yes)
dir_owner(`splunk-user`)
dir_group(`splunk-group`)
dir_perm(0700)
owner(`splunk-user`)
group(`splunk-group`)
perm(0600)
);
};

0 comments on commit c59c14e

Please sign in to comment.