threatstack / threatstack-formula Goto Github PK
View Code? Open in Web Editor NEWA sample saltstack formula for installing Threat Stack agent
Home Page: https://www.threatstack.com
License: Other
A sample saltstack formula for installing Threat Stack agent
Home Page: https://www.threatstack.com
License: Other
The latest version of cloudsight (Threat Stack Agent v1.6.8
) does not allow for getopts, it now requires a single param=value
. The salt state runs a command similar to this:
~# cloudsight config --ruleset="Monitor Base Rule Set" --agent_type=m
2018-02-11T03:12:22.127Z: [-] Usage: cloudsight config "param=value"
Per the error, the config must be passed in one at a time and doesn't support opts:
~# cloudsight config ruleset="Monitor Base Rule Set" agent_type=m
2018-02-11T03:12:28.833Z: [-] Setting: ruleset = Monitor Base Rule Set
~# cloudsight config agent_type=m
2018-02-11T03:12:35.829Z: [-] Setting: agent_type = m
2018-02-11T03:12:35.835Z: [*] Installing audit rules
2018-02-11T03:12:35.838Z: [-] Saved agent type. Please run `sudo cloudsight restart`
Should probably iterate over a list of k=v
in the salt state and pass those to cloudsight config
.
Alternatively the cloudsight deploy
command might be templated to include the extra config stuff.
I use Saltstack to manage threatstack and ran into a an issue where my systems will not start after upgrading from 1.9 to 2.0.
Specifically, after running the state.apply threatstack it updated my minion to run 2.0.0.0ubuntu16.56 but was unable to handle the tsagent configuration change or the service restart. Instead I get
ID: tsagent-config
Function: cmd.wait
Name: tsagent config log_level=debug
Result: False
Comment: Command "tsagent config log_level=debug" run
Started: 09:19:39.352452
Duration: 26.25 ms
Changes:
----------
pid:
28103
retcode:
1
stderr:
tsagent: No option provided to config command
stdout:
----------
ID: threatstack
Function: service.running
Result: False
Comment: One or more requisite failed: threatstack.tsagent-config
Started: 09:19:40.203444
Duration: 0.024 ms
Changes: ```
My pillar looks like this
deploy_key: "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn"
ts_configure: True
ts_agent_latest: True
ts_agent_config_args: 'log_level=debug'
ts_agent_extra_args: --ruleset="Base Rule Set"
Unfortunately, the outlined document from threatstack states that some OS versions can not support the 2.x agent. https://threatstack.zendesk.com/hc/en-us/articles/200343805
the picture above showing an example where centos 6 does not support the 2.x agent
yet the init.sls initial step of determining the boolean for repository choosing does not intuitively determine if the OS can support that version. Many customers have fleets with multiple versions of an OS that need to be managed. considering Salt's use of grains the init.sls should be able to choose correctly.
# Determine if we are installing agent 1.x or agent 2.x
{% if (pillar['ts_agent_latest'] is defined and pillar['ts_agent_latest'] == True) or (pillar['ts_agent_version'] is defined and pillar['ts_agent_version'].startswith('2.')) %}
{% set install_agent2 = True %}
{% else %}
{% set install_agent2 = False %}
{% endif %}
The line above dictates the repo
# Allow for package repo override from pillar
{% if pillar['pkg_url'] is defined %}
{% set pkg_url = pillar['pkg_url'] %}
{% else %}
{% if install_agent2 == True %}
{% set pkg_url_base = 'https://pkg.threatstack.com/v2' %}
{% else %}
{% set pkg_url_base = 'https://pkg.threatstack.com' %}
{% endif %}
recommended resolution:
remove the following
# Determine if we are installing agent 1.x or agent 2.x
{% if (pillar['ts_agent_latest'] is defined and pillar['ts_agent_latest'] == True) or (pillar['ts_agent_version'] is defined and pillar['ts_agent_version'].startswith('2.')) %}
{% set install_agent2 = True %}
{% else %}
{% set install_agent2 = False %}
{% endif %}
extend
{% set pkg_maj_ver = grains['osmajorrelease'] %}
{% if grains['os_family']=="Debian" %}
{% set pkg_url = [pkg_url_base, 'Ubuntu']|join('/') %}
{% elif grains['os']=="Amazon" %}
{% set pkg_url = [pkg_url_base, 'Amazon']|join('/') %}
{% elif grains['os']=="Centos" %}
{% set pkg_url = [pkg_url_base, 'EL', pkg_maj_ver]|join('/') %}
{% else %}
{% set pkg_url = [pkg_url_base, 'EL', '7']|join('/') %}
{% endif %}
perform a nested IF under each OS/OS Family example
{% elif grains['os']=="CentOS" %}
{% if grain['osmajorrelease'] = 7 and pillar['ts_agent_version'].startswith('2.')) %}}
{% set pkg_url_base = 'https://pkg.threatstack.com/v2' %}
{% else %}
{% set pkg_url_base = 'https://pkg.threatstack.com' %}
rinse and repeat for all os families using linked document above so the 2.x agents can not be installed on systems that do not support the 2.x agent.
I am getting this error while installing threatstack-agent
on the latest Debian 11 (released on August 14th) using this formula:
[ERROR ] stderr: E: Failed to fetch https://pkg.threatstack.com/v2/Ubuntu/dists/bullseye/InRelease 403 Forbidden [IP: 65.8.49.125 443]
E: The repository 'https://pkg.threatstack.com/v2/Ubuntu bullseye InRelease' is not signed.
Do you have a target date when this will be available?
The following line section of code does not work accurately when using CentOS.
{% set pkg_maj_ver = grains['osmajorrelease'] %}
{% if grains['os_family']=="Debian" %}
{% set pkg_url = [pkg_url_base, 'Ubuntu']|join('/') %}
{% elif grains['os']=="Amazon" %}
{% set pkg_url = [pkg_url_base, 'Amazon']|join('/') %}
{% elif grains['os']=="Centos" %}
{% set pkg_url = [pkg_url_base, 'EL', pkg_maj_ver]|join('/') %}
{% else %}
{% set pkg_url = [pkg_url_base, 'EL', '7']|join('/') %}
{% endif %}
Salt OS grain value for CentOS systems is "CentOS" NOT "Centos". Due to this CentOS 6 system skip to the finial ELSE statement
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.