Skip to content

Commit 2a18b0f

Browse files
TuningYourCodepcfens
TuningYourCode
authored and
pcfens
committed
Add sophos module
1 parent f13f09a commit 2a18b0f

File tree

2 files changed

+196
-0
lines changed

2 files changed

+196
-0
lines changed

‎manifests/module/sophos.pp‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# filebeat::module::sophos
2+
#
3+
# @summary
4+
# This class manages the Filebeat Sophos module.
5+
#
6+
# @example
7+
# class { 'filebeat::module::sophos':
8+
# xg_enabled => true,
9+
# xg_input => 'udp',
10+
# xg_syslog_host => '0.0.0.0',
11+
# xg_syslog_port => 514,
12+
# xg_host_name => 'sophos-xg',
13+
# }
14+
#
15+
# @param xg_enabled
16+
# Whether to enable the Sophos XG module.
17+
# @param xg_paths
18+
# An array of paths to the Sophos XG logs.
19+
# @param xg_input
20+
# The input type for the Sophos XG module. tcp or udp for syslog input, file for log files.
21+
# @param xg_syslog_host
22+
# Interface to listen to for syslog input.
23+
# @param xg_syslog_port
24+
# Port to listen on for syslog input.
25+
# @param xg_host_name
26+
# Host name / Observer name, since SophosXG does not provide this in the syslog file.
27+
# @param utm_enabled
28+
# Whether to enable the Sophos UTM module.
29+
# @param utm_paths
30+
# An array of paths to the Sophos UTM logs.
31+
# @param utm_input
32+
# The input type for the Sophos UTM module. tcp or udp for syslog input, file for log files.
33+
# @param utm_syslog_host
34+
# Interface to listen to for syslog input.
35+
# @param utm_syslog_port
36+
# Port to listen on for syslog input.
37+
# @param utm_tz_offset
38+
# Timezone offset. If the logs are in a different timezone than the Filebeat host, set this to the timezone offset.
39+
# @param utm_rsa_fields
40+
# Flag to control whether non-ECS fields are added to the event.
41+
# @param utm_keep_raw_fields
42+
# Flag to control the addition of the raw parser fields to the event.
43+
#
44+
class filebeat::module::sophos (
45+
Boolean $xg_enabled = false,
46+
Optional[Array[Stdlib::Absolutepath]] $xg_paths = undef,
47+
Optional[Enum['udp', 'tcp','file']] $xg_input = undef,
48+
Optional[Stdlib::Host] $xg_syslog_host = undef,
49+
Optional[Stdlib::Port] $xg_syslog_port = undef,
50+
Optional[Stdlib::Host] $xg_host_name = undef,
51+
Boolean $utm_enabled = false,
52+
Optional[Array[Stdlib::Absolutepath]] $utm_paths = undef,
53+
Optional[Enum['udp', 'tcp','file']] $utm_input = undef,
54+
Optional[Stdlib::Host] $utm_syslog_host = undef,
55+
Optional[Stdlib::Port] $utm_syslog_port = undef,
56+
Optional[Pattern[/^[-+]\d{2}:\d{2}$/]] $utm_tz_offset = undef,
57+
Optional[Boolean] $utm_rsa_fields = undef,
58+
Optional[Boolean] $utm_keep_raw_fields = undef,
59+
) {
60+
filebeat::module { 'sophos':
61+
config => {
62+
'xg' => delete_undef_values(
63+
{
64+
'enabled' => $xg_enabled,
65+
'var.input' => $xg_input,
66+
'var.paths' => $xg_paths,
67+
'var.syslog_host' => $xg_syslog_host,
68+
'var.syslog_port' => $xg_syslog_port,
69+
'var.host_name' => $xg_host_name,
70+
}
71+
),
72+
'utm' => delete_undef_values(
73+
{
74+
'enabled' => $utm_enabled,
75+
'var.input' => $utm_input,
76+
'var.paths' => $utm_paths,
77+
'var.syslog_host' => $utm_syslog_host,
78+
'var.syslog_port' => $utm_syslog_port,
79+
'var.tz_offset' => $utm_tz_offset,
80+
'var.rsa_fields' => $utm_rsa_fields,
81+
'var.keep_raw_fields' => $utm_keep_raw_fields,
82+
}
83+
),
84+
},
85+
}
86+
}

‎spec/classes/module/sophos_spec.rb‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# frozen_string_literal: true
2+
3+
require 'spec_helper'
4+
5+
describe 'filebeat::module::sophos' do
6+
let :pre_condition do
7+
'include ::filebeat'
8+
end
9+
10+
let(:facts) {
11+
{
12+
:kernel => 'Linux',
13+
:os => {
14+
:family => 'Debian',
15+
:name => 'Ubuntu',
16+
}
17+
}
18+
}
19+
20+
context 'on default values' do
21+
it { is_expected.to compile.with_all_deps }
22+
23+
it {
24+
is_expected.to contain_file('filebeat-module-sophos').with_content(
25+
%r{- module: sophos\n\s{2}xg:\n\s{4}enabled: false\n\s{2}utm:\n\s{4}enabled: false\n\n},
26+
)}
27+
end
28+
29+
context 'on xg and utm enabled with paths' do
30+
let(:params) do
31+
{
32+
'xg_enabled' => true,
33+
'xg_input' => 'file',
34+
'xg_paths' => ['/var/log/xg.log'],
35+
'utm_enabled' => true,
36+
'utm_input' => 'file',
37+
'utm_paths' => ['/var/log/utm.log'],
38+
}
39+
end
40+
41+
it { is_expected.to compile.with_all_deps }
42+
43+
it {
44+
is_expected.to contain_file('filebeat-module-sophos').with_content(
45+
<<-EOS
46+
### Filebeat configuration managed by Puppet ###
47+
---
48+
- module: sophos
49+
xg:
50+
enabled: true
51+
var.input: file
52+
var.paths:
53+
- "/var/log/xg.log"
54+
utm:
55+
enabled: true
56+
var.input: file
57+
var.paths:
58+
- "/var/log/utm.log"
59+
60+
EOS
61+
)
62+
}
63+
end
64+
65+
context 'on xg and utm enabled with syslog input' do
66+
let(:params) do
67+
{
68+
'xg_enabled' => true,
69+
'xg_input' => 'udp',
70+
'xg_syslog_host' => '0.0.0.0',
71+
'xg_syslog_port' => 514,
72+
'xg_host_name' => 'sophos-xg',
73+
'utm_enabled' => true,
74+
'utm_input' => 'tcp',
75+
'utm_syslog_host' => '0.0.0.0',
76+
'utm_syslog_port' => 515,
77+
'utm_tz_offset' => '-07:00',
78+
'utm_rsa_fields' => true,
79+
'utm_keep_raw_fields' => true,
80+
}
81+
end
82+
83+
it { is_expected.to compile.with_all_deps }
84+
85+
it {
86+
is_expected.to contain_file('filebeat-module-sophos').with_content(
87+
<<-EOS
88+
### Filebeat configuration managed by Puppet ###
89+
---
90+
- module: sophos
91+
xg:
92+
enabled: true
93+
var.input: udp
94+
var.syslog_host: 0.0.0.0
95+
var.syslog_port: 514
96+
var.host_name: sophos-xg
97+
utm:
98+
enabled: true
99+
var.input: tcp
100+
var.syslog_host: 0.0.0.0
101+
var.syslog_port: 515
102+
var.tz_offset: "-07:00"
103+
var.rsa_fields: true
104+
var.keep_raw_fields: true
105+
106+
EOS
107+
)
108+
}
109+
end
110+
end

0 commit comments

Comments
 (0)