20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
# File 'manifests/params.pp', line 20
class threatstack::params {
$package_version = 'installed'
$extra_args = undef
$windows_install_options = ['TSEVENTLOGLIST=Security,Microsoft-Windows-Sysmon/Operational']
case $facts['os']['family'] {
'Windows': {
$repo_class = '::threatstack::msi'
$repo_url = undef
$gpg_key = undef
$disable_auditd = false
$windows_base_url = 'https://pkg.threatstack.com/v2/Windows'
$windows_pkg_name = 'Threat+Stack+Cloud+Security+Agent.latest.msi'
$tmp_path = "C:\\Windows\\Temp\\${windows_pkg_name}"
$download_url = "${windows_base_url}/${windows_pkg_name}"
$rulesets = ['Windows Rule Set']
$enable_sysmon = true
$confdir = "C:\\ProgramData\\Threat Stack\\config\\"
$setup_unless = 'tasklist.exe /fi "Imagename eq tsagent*"'
$binpath = ["C:\\Program Files\\Threat Stack\\"]
$cloudsight_bin = "C:\\Program Files\\Threat Stack\\tsagent.exe"
$service_provider = undef
$ts_service = 'Threat Stack Agent'
$ts_package = 'Threat Stack Cloud Security Platform'
}
'RedHat': {
$repo_class = '::threatstack::yum'
$gpg_key = 'https://app.threatstack.com/RPM-GPG-KEY-THREATSTACK'
$gpg_key_file = '/etc/pki/rpm-gpg/RPM-GPG-KEY-THREATSTACK'
$gpg_key_file_uri = "file://${gpg_key_file}"
$disable_auditd = true
$tmp_path = undef
$download_url = undef
$rulesets = ['Base Rule Set']
$enable_sysmon = false
$confdir = '/opt/threatstack/etc'
$setup_unless = 'ps auwwwx| grep [t]sagentd'
$binpath = ['/bin', '/usr/bin']
$cloudsight_bin = '/usr/bin/tsagent'
$ts_service = 'threatstack'
$ts_package = 'threatstack-agent'
case $facts['os']['name'] {
'Amazon': {
if $facts['os']['release']['major'] =~ /^201\d$/ {
$releasever = '1'
$service_provider = 'upstart'
} else {
$releasever = $facts['os']['release']['major']
$service_provider = undef
}
$repo_url = "https://pkg.threatstack.com/v2/Amazon/${releasever}"
}
/(CentOS|RedHat)/: {
$repo_url = "https://pkg.threatstack.com/v2/EL/${::operatingsystemmajrelease}"
$service_provider = undef
}
default: { fail("Module ${module_name} does not support ${::operatingsystem}") }
}
}
'Debian': {
$repo_class = '::threatstack::apt'
$repo_url = 'https://pkg.threatstack.com/v2/Ubuntu'
$repo_gpg_id = 'ACCC2B02EA3A2409557B0AB991BB3B3C6EE04BD4'
$release = $facts['os']['distro']['codename']
$repos = 'main'
$gpg_key = 'https://app.threatstack.com/APT-GPG-KEY-THREATSTACK'
$disable_auditd = false
$tmp_path = undef
$download_url = undef
$rulesets = ['Base Rule Set']
$enable_sysmon = false
$confdir = '/opt/threatstack/etc'
$setup_unless = 'ps auwwwx| grep [t]sagentd'
$binpath = ['/bin', '/usr/bin']
$cloudsight_bin = '/usr/bin/tsagent'
$service_provider = undef
$ts_service = 'threatstack'
$ts_package = 'threatstack-agent'
}
default: {
fail("Module ${module_name} does not support ${::operatingsystem}")
}
}
}
|