Skip to content

Commit fb11d13

Browse files
steveh565steveh565
committed
new waf configs
1 parent 1d44b39 commit fb11d13

File tree

5 files changed

+99
-10
lines changed

5 files changed

+99
-10
lines changed

‎README.md‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ This implementation is designed to deploy into an existing Azure resource-group
2929
### Part I: Regions, Resource Groups, VNets, Subnets, NatGW, NSGs
3030
1. Clone the repo to your local environment.
3131
2. Create a Resource Group in the Azure region of your choice.
32-
3. Create 3 Network Security Groups:
32+
3. Create three Network Security Groups:
3333
- mgmtNsg (default ruleset)
3434
- extNsg (default ruleset)
3535
- intNsg (default ruleset)
@@ -191,6 +191,7 @@ Part V: Deploy the modern observability software stack
191191
for i in `ls -1 *.yml`; do (kubectl apply -n grafana-system -f $i)
192192
```
193193
### Part VI: Initial Setup
194+
194195
23. Extract the ElasticSearch admin password using the following command:
195196
```bash
196197
#Fetch ES Creds
@@ -210,13 +211,13 @@ Part V: Deploy the modern observability software stack
210211
echo ""
211212
```
212213
25. Import the Kibana Dashboards
213-
- Login to ElasticSearch with credentials retrieved in Step 23.
214-
- In the Main Menu, select Stack Management
215-
- In the new menu, under Kibana, select Data Management
216-
- Select Dashboards
217-
- Select Import
218-
- Browse to the local copy of the kibana dashboards and select the first bundle (.ndjson)
219-
- Repeat for the second and third bundle
214+
- Login to ElasticSearch with credentials retrieved in Step 23.
215+
- In the Main Menu, select Stack Management
216+
- In the new menu, under Kibana, select Data Management
217+
- Select Dashboards
218+
- Select Import
219+
- Browse to the local copy of the kibana dashboards and select the first bundle (.ndjson)
220+
- Repeat for the second and third bundle
220221
221222
### Part V: Out of the box functionality
222223

‎f5BigIp/irules/userDefinedViolation.tcl‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
when RULE_INIT {
2+
#debug logging flag
3+
set debug 0
4+
}
5+
6+
when HTTP_REQUEST {
7+
# get LTM policy matched rule and chosen ASM security policy
8+
set policy [POLICY::names matched]
9+
if { $debug } {
10+
log local0. "Matched policy [POLICY::names matched]"
11+
log local0. "Matched rule in policy [POLICY::rules matched]"
12+
log local0. "ASM policy [ASM::policy] enforcing"
13+
}
14+
}
15+
16+
when ASM_REQUEST_DONE {
17+
# define custom violation conditions
18+
# user-defined violation: VIOLATION_TOO_MANY_VIOLATIONS
19+
set violationName "VIOLATION_TOO_MANY_VIOLATIONS"
20+
if {[ASM::violation count] > 20 and [ASM::severity] eq "Error"} {
21+
ASM::raise $violationName
22+
}
23+
# user-defined violation: X
24+
# debug logging
25+
if { $debug } {
26+
log local0. "SupportID: [ASM::support_id];"
27+
log local0. "Request Status: [ASM::status];"
28+
log local0. "Severity: [ASM::severity];"
29+
log local0. "ClientIP: [ASM::client_ip];"
30+
log local0. "Number Violations: [ASM::violation count]"
31+
log local0. "Violations Names: [ASM::violation names];"
32+
log local0. "Attack Types: [ASM::violation attack_types];"
33+
log local0. "Violation details: [ASM::violation details];"
34+
}
35+
}
36+
37+
when ASM_REQUEST_VIOLATION {
38+
if { $debug } {
39+
log local0. "SupportID: [ASM::support_id];"
40+
log local0. "Request Status: [ASM::status];"
41+
log local0. "Severity: [ASM::severity];"
42+
log local0. "ClientIP: [ASM::client_ip];"
43+
log local0. "Number Violations: [ASM::violation count]"
44+
log local0. "Violations Names: [ASM::violation names];"
45+
log local0. "Attack Types: [ASM::violation attack_types];"
46+
log local0. "Violation details: [ASM::violation details];"
47+
}
48+
}
49+
50+
when ASM_RESPONSE_VIOLATION {
51+
if { $debug } {
52+
log local0. "SupportID: [ASM::support_id];"
53+
log local0. "Request Status: [ASM::status];"
54+
log local0. "Severity: [ASM::severity];"
55+
log local0. "ClientIP: [ASM::client_ip];"
56+
log local0. "Number Violations: [ASM::violation count]"
57+
log local0. "Violations Names: [ASM::violation names];"
58+
log local0. "Attack Types: [ASM::violation attack_types];"
59+
log local0. "Violation details: [ASM::violation details];"
60+
}
61+
}
62+
63+
when ASM_REQUEST_BLOCKING {
64+
if { $debug } {
65+
log local0. "SupportID: [ASM::support_id];"
66+
log local0. "Request Status: [ASM::status];"
67+
log local0. "Severity: [ASM::severity];"
68+
log local0. "ClientIP: [ASM::client_ip];"
69+
log local0. "Number Violations: [ASM::violation count]"
70+
log local0. "Violations Names: [ASM::violation names];"
71+
log local0. "Attack Types: [ASM::violation attack_types];"
72+
log local0. "Violation details: [ASM::violation details];"
73+
}
74+
}

‎helm/argocd/argo.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@ helm install --upgrade argocd-stack argo/argo-cd -n argocd --create-namespace --
99

1010
# show elastic-operator logs
1111
argoPass=`kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d`
12-
echo "Username: elastic"
12+
echo "Username: admin"
1313
echo "Password: ${argoPass}"
1414
echo ""

‎terraform/az-auto-scaleset-byol/alb.tf‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ resource "azurerm_public_ip" "lbpip" {
77
sku = "Standard"
88
resource_group_name = data.azurerm_resource_group.main.name
99
allocation_method = "Static"
10-
domain_name_label = "overwatch-lbpip"
10+
domain_name_label = "ingress-lbpip"
1111
tags = {
1212
owner = var.resourceOwner
1313
}
@@ -73,6 +73,20 @@ resource "azurerm_lb_rule" "lb_rule-https" {
7373
probe_id = azurerm_lb_probe.lb_probe.id
7474
}
7575

76+
# Create frontend LB rule
77+
resource "azurerm_lb_rule" "lb_rule-f5SyslogTcp" {
78+
name = "LBRule-Syslog-TCP"
79+
loadbalancer_id = azurerm_lb.lb.id
80+
protocol = "Tcp"
81+
frontend_port = 8514
82+
backend_port = 8514
83+
frontend_ip_configuration_name = "LoadBalancerFrontEnd"
84+
enable_floating_ip = false
85+
backend_address_pool_ids = [azurerm_lb_backend_address_pool.backend_pool.id]
86+
idle_timeout_in_minutes = 5
87+
probe_id = azurerm_lb_probe.lb_probe.id
88+
}
89+
7690
# Create frontend LB rule
7791
resource "azurerm_lb_rule" "lb_rule-syslogTcp" {
7892
name = "LBRule-Syslog-TCP"

‎terraform/az-tux/terraform.tfvars.example‎

Whitespace-only changes.

0 commit comments

Comments
 (0)