| # |
| # Licensed to the Apache Software Foundation (ASF) under one or more |
| # contributor license agreements. See the NOTICE file distributed with |
| # this work for additional information regarding copyright ownership. |
| # The ASF licenses this file to You under the Apache License, Version 2.0 |
| # (the "License"); you may not use this file except in compliance with |
| # the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, software |
| # distributed under the License is distributed on an "AS IS" BASIS, |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| # See the License for the specific language governing permissions and |
| # limitations under the License. |
| # |
| --- |
| metron_jar_name: Metron-Topologies-{{ metron_version }}.jar |
| metron_directory: /usr/metron/{{ metron_version }} |
| metron_solr_jar_name: Metron-Solr-{{ metron_version }}.jar |
| metron_elasticsearch_jar_name: Metron-Elasticsearch-{{ metron_version }}.jar |
| |
| metron_dataloads_name: Metron-DataLoads-{{ metron_version }}-archive.tar.gz |
| metron_dataloads_path: "{{ playbook_dir }}/../../metron-streaming/Metron-DataLoads/target/{{ metron_dataloads_name }}" |
| metron_topologies_bundle_name: Metron-Topologies-{{ metron_version }}-archive.tar.gz |
| metron_solr_bundle_name: Metron-Solr-{{ metron_version }}-archive.tar.gz |
| metron_elasticsearch_bundle_name: Metron-Elasticsearch-{{ metron_version }}-archive.tar.gz |
| metron_solr_bundle_path: "{{ playbook_dir }}/../../metron-streaming/Metron-Solr/target/{{ metron_solr_bundle_name }}" |
| metron_elasticsearch_bundle_path: "{{ playbook_dir }}/../../metron-streaming/Metron-Elasticsearch/target/{{ metron_elasticsearch_bundle_name }}" |
| metron_topologies_bundle_path: "{{ playbook_dir }}/../../metron-streaming/Metron-Topologies/target/{{ metron_topologies_bundle_name }}" |
| |
| config_path: "{{ metron_directory }}/config" |
| zookeeper_config_path: "{{ config_path }}/zookeeper" |
| zookeeper_global_config_path: "{{ zookeeper_config_path }}/global.json" |
| metron_solr_properties_config_path: "{{ metron_directory }}/config/etc/env/solr.properties" |
| metron_elasticsearch_properties_config_path: "{{ metron_directory }}/config/etc/env/elasticsearch.properties" |
| hbase_config_path: "/etc/hbase/conf" |
| hdfs_config_path: "/etc/hadoop/conf" |
| |
| threat_intel_bulk_load: True |
| threat_intel_bin: "{{ metron_directory }}/bin/threatintel_bulk_load.sh" |
| threat_intel_work_dir: /tmp/ti_bulk |
| threat_intel_csv_filename: "threat_ip.csv" |
| threat_intel_csv_filepath: "../roles/metron_streaming/templates/{{ threat_intel_csv_filename }}" |
| |
| pycapa_topic: pcap |
| bro_topic: bro |
| yaf_topic: yaf |
| snort_topic: snort |
| enrichments_topic: enrichments |
| storm_topologies: |
| - "{{ metron_directory }}/config/topologies/bro/remote.yaml" |
| - "{{ metron_directory }}/config/topologies/snort/remote.yaml" |
| - "{{ metron_directory }}/config/topologies/yaf/remote.yaml" |
| - "{{ metron_directory }}/config/topologies/pcap/remote.yaml" |
| - "{{ metron_directory }}/config/topologies/enrichment/remote.yaml" |
| |
| hdfs_retention_days: 30 |
| hdfs_bro_purge_cronjob: "{{ metron_directory }}/bin/prune_hdfs_files.sh -f {{ hdfs_url }} -g '/apps/metron/enrichment/indexed/bro_doc/*enrichment-*' -s $(date -d '{{ hdfs_retention_days }} days ago' +%m/%d/%Y) -n 1 >> /var/log/bro-purge/cron-hdfs-bro-purge.log 2>&1" |
| hdfs_yaf_purge_cronjob: "{{ metron_directory }}/bin/prune_hdfs_files.sh -f {{ hdfs_url }} -g '/apps/metron/enrichment/indexed/yaf_doc/*enrichment-*' -s $(date -d '{{ hdfs_retention_days }} days ago' +%m/%d/%Y) -n 1 >> /var/log/yaf-purge/cron-hdfs-yaf-purge.log 2>&1" |
| hdfs_snort_purge_cronjob: "{{ metron_directory }}/bin/prune_hdfs_files.sh -f {{ hdfs_url }} -g '/apps/metron/enrichment/indexed/snort_doc/*enrichment-*' -s $(date -d '{{ hdfs_retention_days }} days ago' +%m/%d/%Y) -n 1 >> /var/log/yaf-purge/cron-hdfs-yaf-purge.log 2>&1" |
| |
| elasticsearch_config_path: /etc/elasticsearch |
| elasticsearch_cluster_name: metron |
| elasticsearch_transport_port: 9300 |
| |
| es_retention_days: 30 |
| es_bro_purge_cronjob: "{{ metron_directory }}/bin/prune_elasticsearch_indices.sh -z {{ zookeeper_url }} -p bro_index_ -s $(date -d '{{ es_retention_days }} days ago' +%m/%d/%Y) -n 1 >> /var/log/bro-purge/cron-es-bro-purge.log 2>&1" |
| es_yaf_purge_cronjob: "{{ metron_directory }}/bin/prune_elasticsearch_indices.sh -z {{ zookeeper_url }} -p yaf_index_ -s $(date -d '{{ es_retention_days }} days ago' +%m/%d/%Y) -n 1 >> /var/log/yaf-purge/cron-es-yaf-purge.log 2>&1" |
| es_snort_purge_cronjob: "{{ metron_directory }}/bin/prune_elasticsearch_indices.sh -z {{ zookeeper_url }} -p yaf_index_ -s $(date -d '{{ es_retention_days }} days ago' +%m/%d/%Y) -n 1 >> /var/log/snort-purge/cron-es-snort-purge.log 2>&1" |
| |
| metron_hdfs_output_dir: "/apps/metron" |
| metron_hdfs_rotation_policy: org.apache.storm.hdfs.bolt.rotation.TimedRotationPolicy |
| metron_hdfs_rotation_policy_count: 1 |
| metron_hdfs_rotation_policy_units: DAYS |
