Allow new plugin for intrusion proxy sensor 'alert_http' for http-based alerts

resources/providers/config.rb

@@ -118,14 +118,22 @@
                end
 
         args = "-Q #{args}" if mode == 'IPS'
+
+        output_plugin = ''
+        output_plugin = if node['redborder']['cloud'] == true || node['redborder']['cloud'].to_s == '1'
+                          'alert_http'
+                        else
+                          'alert_kafka'
+                        end
+
         template "/etc/snort/#{instance_name}/env" do
           source 'env.erb'
           cookbook 'snort3'
           owner 'root'
           group 'root'
           mode '0644'
           retries 2
-          variables(iface: iface, cpu_cores: cpu_cores, threads: threads, mode: mode, inline: inline, args: args)
+          variables(iface: iface, cpu_cores: cpu_cores, threads: threads, mode: mode, inline: inline, args: args, output_plugin: output_plugin)
           notifies :stop, "service[snort3@#{instance_name}.service]", :delayed
           notifies :start, "service[snort3@#{instance_name}.service]", :delayed
         end

resources/templates/default/config.lua.erb

@@ -252,13 +252,35 @@ rate_filter =
 %>
 
 <% end %>
+
+<%#— pick mode based on cloud flag —%>
+<% if node["redborder"]["cloud"] == true || node["redborder"]["cloud"].to_s == "1" %>
+
+---------------------------------------------------------------------------
+--- HTTP output plugin
+---------------------------------------------------------------------------
+
+alert_http = {
+    http_endpoint =  "https://http2k.<%= node["redborder"]["cdomain"] %>/rbdata/<%= node["redborder"]["sensor_uuid"] %>/rb_event",
+    verify_ssl =     false,
+    enrichment =    '<%= enrichment_json %>',
+    fields = 'src dst priority src_country_code dst_country_code sig_id ethlength_range sig_generator action msg class src_port dst_port eth_dst_mac eth_src_mac eth_dst eth_src vlan iplen udplen'
+}
+
+<% else %>
+
+---------------------------------------------------------------------------
+--- kafka output plugin
+---------------------------------------------------------------------------
+
 alert_kafka = {
-    topic = 'rb_event',
-    broker_host = 'kafka.service:9092',
-    enrichment = '<%=enrichment_json%>',
+    topic =         "rb_event",
+    broker_host =   "kafka.<%= node["redborder"]["cdomain"] %>:9092",
+    enrichment =    '<%= enrichment_json %>',
     fields = 'src dst priority src_country_code dst_country_code sig_id ethlength_range sig_generator action msg class src_port dst_port eth_dst_mac eth_src_mac eth_dst eth_src vlan iplen udplen'
 }
 
+<% end %>
 ---------------------------------------------------------------------------
 -- 8. configure tweaks
 ---------------------------------------------------------------------------

resources/templates/default/env.erb

@@ -3,3 +3,4 @@ CPU_CORES=<%=@cpu_cores%>
 THREADS=<%=@threads%>
 INLINE=<%=@inline%>
 ARGS=<%=@args%>
+OUTPUT_PLUGIN=<%=@output_plugin%>