mirror of https://github.com/avast/PurpleDome
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
103 lines
3.5 KiB
Python
103 lines
3.5 KiB
Python
3 years ago
|
#!/usr/bin/env python3
|
||
|
|
|
||
|
|
# A plugin to experiment with Linux logstash filebeat sensors
|
||
|
|
|
||
|
|
from plugins.base.sensor import SensorPlugin
|
||
|
|
import os
|
||
|
|
import time
|
||
|
|
from jinja2 import Environment, FileSystemLoader, select_autoescape
|
||
|
|
|
||
|
|
|
||
|
|
class LinuxFilebeatPlugin(SensorPlugin):
|
||
|
|
# Boilerplate
|
||
|
|
name = "linux_filebeat"
|
||
|
|
description = "Linux filebeat plugin"
|
||
|
|
|
||
|
|
required_files = ["filebeat.conf",
|
||
|
|
"filebeat.yml",
|
||
|
|
]
|
||
|
|
|
||
|
|
def __init__(self):
|
||
|
|
super().__init__()
|
||
|
|
self.plugin_path = __file__
|
||
|
|
|
||
|
|
self.debugit = False
|
||
|
|
|
||
|
|
def process_templates(self):
|
||
|
|
""" process jinja2 templates of the config files and insert own config """
|
||
|
|
|
||
|
|
# TODO: Implement
|
||
|
|
|
||
|
|
env = Environment(
|
||
|
|
loader=FileSystemLoader(self.get_plugin_path(), encoding='utf-8', followlinks=False),
|
||
|
|
autoescape=select_autoescape()
|
||
|
|
)
|
||
|
|
template = env.get_template("filebeat_template.conf")
|
||
|
|
dest = os.path.join(self.get_plugin_path(), "filebeat.conf")
|
||
|
|
with open(dest, "wt") as fh:
|
||
|
|
res = template.render({"playground": self.get_playground()})
|
||
|
|
fh.write(res)
|
||
|
|
|
||
|
|
def prime(self):
|
||
|
|
""" Hard-core install. Requires a reboot """
|
||
|
|
|
||
|
|
# For reference: This is the core config we will need. In addition there are two reg files to apply to the registry
|
||
|
|
# sc control aswbidsagent 255
|
||
|
|
# timeout /t 5
|
||
|
|
# 'copy /y "cd %userprofile% & aswidptestdll.dll" "c:\Program Files\Avast Software\Avast\"'
|
||
|
|
# reg.exe add "HKLM\SOFTWARE\Avast Software\Avast\properties\IDP\Setting" /v debug_channel.enabled /t REG_DWORD /d 1 /f
|
||
|
|
# timeout /t 2
|
||
|
|
# sc start aswbidsagent
|
||
|
|
|
||
|
|
# Important: AV must be 21.2
|
||
|
|
# dll_name = self.conf["dll_name"]
|
||
|
|
|
||
|
|
# idp_tool_folder = self.conf["idp_tool_folder"]
|
||
|
|
|
||
|
|
pg = self.get_playground()
|
||
|
|
|
||
|
|
self.vprint("Installing Linux filebeat sensor", 3)
|
||
|
|
|
||
|
|
self.run_cmd(f"sudo wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -")
|
||
|
|
self.run_cmd('sudo echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-7.x.list')
|
||
|
|
self.run_cmd("sudo apt update")
|
||
|
|
self.run_cmd("sudo apt -y install default-jre")
|
||
|
|
self.run_cmd("sudo apt -y install logstash")
|
||
|
|
self.run_cmd("sudo apt -y install filebeat")
|
||
|
|
|
||
|
|
# Copy config
|
||
|
|
self.run_cmd(f"sudo cp {pg}/filebeat.yml /etc/filebeat/filebeat.yml")
|
||
|
|
self.run_cmd(f"sudo cp {pg}/filebeat.conf /etc/logstash/conf.d")
|
||
|
|
|
||
|
|
# Cleanup
|
||
|
|
self.run_cmd(f"rm {pg}/filebeat.json")
|
||
|
|
self.run_cmd(f"touch {pg}/filebeat.json")
|
||
|
|
self.run_cmd(f"chmod o+w {pg}/filebeat.json")
|
||
|
|
|
||
|
|
return False
|
||
|
|
|
||
|
|
def install(self):
|
||
|
|
""" Installs the filebeat sensor """
|
||
|
|
|
||
|
|
return
|
||
|
|
|
||
|
|
def start(self):
|
||
|
|
|
||
|
|
self.run_cmd("sudo filebeat modules enable system,iptables")
|
||
|
|
self.run_cmd("sudo filebeat setup --pipelines --modules iptables,system,")
|
||
|
|
self.run_cmd("sudo systemctl enable filebeat")
|
||
|
|
self.run_cmd("sudo systemctl start filebeat")
|
||
|
|
self.run_cmd("sudo systemctl enable logstash.service")
|
||
|
|
self.run_cmd("sudo systemctl start logstash.service")
|
||
|
|
|
||
|
|
return None
|
||
|
|
|
||
|
|
def stop(self):
|
||
|
|
""" Stop the sensor """
|
||
|
|
return
|
||
|
|
|
||
|
|
def collect(self, path):
|
||
|
|
""" Collect sensor data """
|
||
|
|
|
||
|
|
pg = self.get_playground()
|
||
|
|
self.get_from_machine(f"{pg}/filebeat.json", os.path.join(path, "filebeat.json")) # nosec
|