search

StamusNetworks / scirius

Scirius is a web application for Suricata ruleset management and threat hunting.
GNU General Public License v3.0
626 stars 150 forks source link

Using X-Pack with Elasticsearch #130

Open acalabrigo opened 6 years ago

acalabrigo commented 6 years ago

I'm wondering if Scirius can be configured to work with an Elasticsearch instance that is authenticated via X-Pack?

acalabrigo commented 6 years ago

I'm running Scirius 1.2.8, and I currently have it working with an authenticated Elasticsearch cluster. I did this by adding authentication settings to scirius/settings.py, parsing them in rules/models.py, and then changing the urlopen calls in rules/es_graphs.py to include an authentication header when the authentication settings are used.

acalabrigo commented 6 years ago

Reopening incase this feature might be beneficial.

pevma commented 6 years ago

Very well! Thanks for sharing. I was talking to @regit about this - it seem this is one way to do it he mentioned - but we need to find out a more generic one and include in the next upgrade.

lukelee1987 commented 6 years ago

@acalabrigo , may I know what did you modify in the file mentioned below:

I did this by adding authentication settings to scirius/settings.py, parsing them in rules/models.py, and then changing the urlopen calls in rules/es_graphs.py to include an authentication header when the authentication settings are used.

gstorme commented 5 years ago

I would also like to know these changes, could you please share them?