Policy inventory settings¶
Push content settings¶
You can use Corelight-update to push content to Corelight Sensors. It supports both Fleet-managed and stand-alone sensors. To push content to sensors, it must be enabled in a policy. Pushing content is disabled by default.
Once pushing content is enabled at the policy level, it can be overridden for non-Fleet-managed at the individual sensor level in the inventory for that policy. See Inventory settings below for details.
The policy settings for pushing content are:
# Push Content to Sensors
push_content:
intel: false
input: false
package_bundle: false
suricata: false
suricata_configs: false
Tip
Force Pushing Content
By default, Corelight-update will only push new content to sensors. If you add a sensor to the policy, no content is pushed to it until new content is generated. You can use the CLI to force push existing content to sensors. See CLI commands for details.
The policy inventory can include Fleet Manager details and/or a list of the Corelight sensors to deploy content to using Corelight-update. The sensors can be a combination of appliances, such as the hardware, virtual, and software sensors.
Sensors that are Fleet managed do not need to be listed individually in the Corelight-update inventory. Corelight-update will utilize Fleet Manager to deploy content to those sensors. For sensors that aren’t Fleet managed, you can push content directly to them by listing their details in the inventory.
If you have version 1.x software sensors, you can use Corelight-update to either push content to the software sensor, or publish threat intel content using Corelight-update’s web interface for the software sensor to fetch.
Overview of adding Fleet Manager and sensor details to the inventory¶
Prepare a list of the sensors that Corelight-update will deploy to.
For Fleet-managed sensors, the sensor inventory will be collected from Fleet Manager.
For all standalone appliance sensors: collect the IP address or FQDN, and the sensor username and password.
For all version 1.x software sensors: collect the IP address or FQDN, and the host ssh key, or the sensor username and password.
If you have Fleet-managed sensors, configure the connection to your Fleet Manager instance under the
fleet:
section of the Corelight-updatedb-config
file.Configure the inventory settings under the
sensors:
portion of the Corelight-update configuration file, adding a new-name
inventory section and associated fields for each non-Fleet managed sensor type in your inventory.Use the configuration file to update the policy in Corelight-update.
Inventory settings¶
The following fields are available for configuring the inventory:
fleet:
ip: # fleet address or fqdn
username: # fleet username
password: # fleet password, leave blank to use encrypted password
encrypted_pass: # use the 'encrypt' CLI command to encrypt a password before it's stored here
ignore_tls: true
sensor_policy: # the name of the sensor policy in Fleet Manager (required if different from the Corelight-update policy)
suricata_policy: # the name of the suricata policy in Fleet Manager (required if different from the Corelight-update policy)
intel_policy: # the name of the intel policy in Fleet Manager (required if different from the Corelight-update policy)
sensors:
- name: # sensor name
type: # physical, virtual, software or localhost
fleet: false # true or false
ip: # address or fqdn
username: # sensor username
password: # set to "ssh-key" to use ssh keys with softsensor, leave blank to use encrypted password
encrypted_pass: # use the 'encrypt' CLI command to encrypt a password before it's stored here
ignore_tls: true # physical and virtual sensors ONLY
suricata: true # push suricata rulesets to this sensor
intel: true # push intel files to this sensor
input: true # push input files to this sensor
bundle: true # push package bundle to this sensor
intel_path: "/etc/corelight/intel/intel.dat" # software sensors and localhost ONLY
input_path: "/etc/corelight/input_files/" # software sensors and localhost ONLY
suricata_path: "/etc/corelight/rules/suricata.rules" # software sensors and localhost ONLY
suricata_config_path: "/etc/corelight/suricata/" # software sensors and localhost ONLY
bundle_path: "/etc/corelight/corelight.bundle" # software sensors ONLY
Warning
The suricata_config_path /etc/corelight/suricata/
does not exist by default on Microsensors and must be created before Suricata config files
can be pushed. The folder must be writable for the username listed for that sensor.
Encrypted Passwords
Fleet and individual sensor passwords should be encrypted before they are stored in inventory. Using the encrypted_pass
field allows you to replace the use of plain text passwords in your Corelight-update configuration file. See Administering encrypted passwords later in this topic.
Administering encrypted passwords¶
Fleet and individual sensor passwords should be encrypted before they are stored in inventory. Using the encrypted_pass
field allows you to replace the use of plain text passwords in your Corelight-update configuration file.
To use encrypted passwords:
Use the Corelight-update CLI command with the in
encrypt
switch to encrypt the password string. When using special characters in your password string, wrap it in quotes. See CLI commands for more details.Copy the encrypted password output from the console, and use it to update the
encrypted_pass:
field of the sensor inventory record, or Fleet configuration in the policy configuration file.Verify the
password:
field of the sensor inventory record, or Fleet configuration is empty.Save the changes, and update the Corelight-update policy.
Note
A Fleet Manager configuration or sensor inventory record should not have both the password
and encrypted_pass
fields populated. Make sure to leave the password
field blank when using the encrypted_pass
field. If both fields are populated, the password
field will be used.
Using the Corelight-update CLI command with the in encrypt
switch encrypts the password string using AES256 encryption. The encryption master key is randomly generated, and stored in the file /var/corelight-update/.corelight-update
.
If the master key is removed and regenerated, all encrypted passwords will also have to be regenerated. A password must be encrypted with the current key to be decrypted successfully.
To generate a new master key, delete the existing key, and a new one will automatically be created when needed.