Current state of Sharingan role -- still need to add rkhunter

.gitignore

@@ -1,7 +1,8 @@
-roles/Node/files/**
+roles/Node/files/*-vm.service
 roles/Nazara/files/dns
 roles/Nazara/files/dhcp
 venv/
+**pkg.tar.zst
 
 # ---> Python
 # Byte-compiled / optimized / DLL files

examples/msn0.yml

@@ -77,36 +77,6 @@ all:
                             vnc: 7
                             disks:
                               - '-drive format=qcow2,l2-cache-size=8M,file=/srv/maat/vm/Maat.qcow2'
-                        test1:
-                            ip: 10.0.1.19
-                            ipinterface: ens3
-                            mac: 00:15:5d:01:02:06
-                            cores: 2
-                            memory: 2
-                            bridge: br0
-                            vnc: 6
-                            disks:
-                              - '-drive format=qcow2,l2-cache-size=8M,file=/srv/maat/vm/test1.qcow2'
-                        test2:
-                            ip: 10.0.1.20
-                            ipinterface: ens3
-                            mac: 00:15:5d:01:02:05
-                            cores: 2
-                            memory: 2
-                            bridge: br0
-                            vnc: 5
-                            disks:
-                              - '-drive format=qcow2,l2-cache-size=8M,file=/srv/maat/vm/test2.qcow2'
-                        test3:
-                            ip: 10.0.1.21
-                            ipinterface: ens3
-                            mac: 00:15:5d:01:02:04
-                            cores: 2
-                            memory: 2
-                            bridge: br0
-                            vnc: 4
-                            disks:
-                              - '-drive format=qcow2,l2-cache-size=8M,file=/srv/maat/vm/test3.qcow2'
 
                 geth_hubs: # 10.0.1.32/28
                     vars:
@@ -168,7 +138,36 @@ all:
                             disks:
                               - '-drive if=none,id=disk0,cache=none,format=raw,aio=native,file=/dev/sdc'
                               - '-cdrom /srv/maat/iso/archlinux.iso -boot order=d'
-
+                        test1:
+                            ip: 10.0.1.52
+                            ipinterface: ens3
+                            mac: 00:15:5d:01:02:06
+                            cores: 2
+                            memory: 2
+                            bridge: br0
+                            vnc: 6
+                            disks:
+                              - '-drive format=qcow2,l2-cache-size=8M,file=/srv/maat/vm/test1.qcow2'
+                        test2:
+                            ip: 10.0.1.53
+                            ipinterface: ens3
+                            mac: 00:15:5d:01:02:05
+                            cores: 2
+                            memory: 2
+                            bridge: br0
+                            vnc: 5
+                            disks:
+                              - '-drive format=qcow2,l2-cache-size=8M,file=/srv/maat/vm/test2.qcow2'
+                        test3:
+                            ip: 10.0.1.54
+                            ipinterface: ens3
+                            mac: 00:15:5d:01:02:04
+                            cores: 2
+                            memory: 2
+                            bridge: br0
+                            vnc: 4
+                            disks:
+                              - '-drive format=qcow2,l2-cache-size=8M,file=/srv/maat/vm/test3.qcow2'
                 appliances:
                     hosts: # 10.0.1.64/27
                         Shadowfeed:

roles/Sharingan/README.md

@@ -55,3 +55,20 @@ See [[WebServer#Available Clients|AniNIX::Webserver's client list]].
 # Equivalents or Competition
 
 Various monitoring SaaS vendors are available, including Nagios, OP5, PagerDuty, etc. A variety of paid cybersecurity vendors are also on the market, particularly contract firms. Data aggregation is also oft used via the ElasticStack for a number of use-cases. We chose Graylog because it unifies these funtions for what we care about -- alarming on actionable events, whether they are malicious or accidental.
+We will use a variety of tools here to feed into the Sharingan SIEM.
+
+# Network IDS: Suricata
+
+We use Suricata to scan network data to identify threats.
+
+## Rules engine: oinkmaster
+
+# Network IPS: sshguard
+
+# WAF: modsecurity
+
+# Vulnerability management: lynis
+
+# Host IDS: rkhunter
+
+

roles/Sharingan/files/lynis/freshclam.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Sharingan-IDS | Freshclam service
+
+[Service]
+Nice=19
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+Type=simple
+ExecStart=freshclam
+User=root
+group=root
+
+[Install]
+WantedBy=multi-user.target

roles/Sharingan/files/lynis/freshclam.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Sharingan-IDS | Update AV definitions
+
+[Timer]
+OnCalendar=14:00
+Persistent=false
+
+[Install]
+WantedBy=timers.target
+
+#EOF

roles/Sharingan/files/lynis/sharingan-vulns.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Sharingan-IDS | rkhunter HIDS
+
+[Service]
+Nice=19
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+Type=simple
+ExecStart=rkhunter --check --sk
+User=root
+group=root
+
+[Install]
+WantedBy=multi-user.target

roles/Sharingan/files/lynis/sharingan-vulns.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Sharingan-IDS | rkhunter timer
+
+[Timer]
+OnCalendar=15:00
+Persistent=false
+
+[Install]
+WantedBy=timers.target
+
+#EOF

roles/Sharingan/files/oinkmaster.conf

@@ -0,0 +1,425 @@
+# $Id: oinkmaster.conf,v 1.132 2006/02/02 12:05:08 andreas_o Exp $ #
+
+# This file is pretty big by default, but don't worry. 
+# The only things required are "path" and "update_files". You must also 
+# set "url" to point to the correct rules archive for your version of 
+# Snort, unless you prefer to specify this on the command line.
+# The rest in here is just a few recommended defaults, and examples
+# how to use all the other optional features and give some ideas how they 
+# could be used.
+
+# Remember not to let untrusted users edit Oinkmaster configuration
+# files, as things like the PATH to use during execution is defined
+# in here.
+
+
+
+# Use "url = <url>" to specify the location of the rules archive to 
+# download. The url must begin with http://, https://, ftp://, file:// 
+# or scp:// and end with .tar.gz or .tgz, and the file must be a 
+# gzipped tarball what contains a directory named "rules".
+# You can also point to a local directory with dir://<directory>.
+# Multiple "url = <url>" lines can be specified to grab multiple rules
+# archives from different locations.
+#
+# Note: if URL is specified on the command line, it overrides all 
+#       possible URLs specified in the configuration file(s).
+#
+# The location of the official Snort rules you should use depends
+# on which Snort version you run. Basically, you should go to
+# http://www.snort.org/rules/ and follow the instructions
+# there to pick the right URL for your version of Snort
+# (and remember to update the URL when upgrading Snort in the
+# future). You can of course also specify locations to third party 
+# rules.
+#
+# As of March 2005, you must register on the Snort site to get access 
+# to the official Snort rules. This will get you an "oinkcode".
+# You then specify the URL as
+# http://www.snort.org/pub-bin/oinkmaster.cgi/<oinkcode>/<filename>
+# For example, if your code is 5a081649c06a277e1022e1284b and
+# you use Snort 2.4, the url to use would be (without the wrap):
+# http://www.snort.org/pub-bin/oinkmaster.cgi/
+# 5a081649c06a277e1022e1284bdc8fabda70e2a4/snortrules-snapshot-2.4.tar.gz
+# See the Oinkmaster FAQ Q1 and http://www.snort.org/rules/ for
+# more information.
+
+
+# URL examples follows. Replace <oinkcode> with the code you get on the 
+# Snort site in your registered user profile.
+
+# Example for Snort
+# url = http://www.snort.org/pub-bin/oinkmaster.cgi/157f1670c58caa1bcb3e4de0d68e96c7e12a08ca/snortrules-snapshot-2976.tar.gz
+
+# Suricata
+ url = http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz
+
+# Example for Community rules
+# url = http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules.tar.gz
+
+# Example for rules from the Bleeding Snort project
+# url = http://www.bleedingsnort.com/bleeding.rules.tar.gz
+
+# If you prefer to download the rules archive from outside Oinkmaster,
+# you can then point to the file on your local filesystem by using
+# file://<filename>, for example:
+# url = file:///tmp/snortrules.tar.gz
+
+# In rare cases you may want to grab the rules directly from a
+# local directory (don't confuse this with the output directory).
+# url = dir:///etc/snort/src/rules
+
+# Example to use scp to copy the rules archive from another host.
+# Only OpenSSH is tested. See the FAQ for more information.
+# url = scp://user@somehost.example.com:/somedir/snortrules.tar.gz
+
+# If you use -u scp://... and need to specify a private ssh key (passed 
+# as -i <key> to the scp command) you can specify it here or add an 
+# entry in ~/.ssh/config for the Oinkmaster user as described in the 
+# OpenSSH manual. 
+# scp_key = /home/oinkmaster/oinkmaster_privkey
+
+
+# The PATH to use during execution. If you prefer to use external 
+# binaries (i.e. use_external_bins=1, see below), tar and gzip must be 
+# found, and also wget if downloading via ftp, http or https. All with 
+# optional .exe suffix. If you're on Cygwin, make sure that the path 
+# contains the Cygwin binaries and not the native Win32 binaries or 
+# you will get problems.
+# Assume UNIX style by default:
+path = /bin:/usr/bin:/usr/local/bin
+
+# Example if running native Win32 or standalone Cygwin:
+# path = c:\oinkmaster;c:\oinkmaster\bin
+
+# Example if running standalone Cygwin and you prefer Cygwin style path:
+# path = /cygdrive/c/oinkmaster:/cygdrive/c/oinkmaster/bin
+
+
+# We normally use external binaries (wget, tar and gzip) since they're 
+# already available on most systems and do a good job. If you have the 
+# Perl modules Archive::Tar, IO::Zlib and LWP::UserAgent, you can use
+# those instead if you like. You can set use_external_bins below to 
+# choose which method you prefer. It's set to 0 by default on Win32 
+# (i.e. use Perl modules), and 1 on other systems (i.e. use external 
+# binaries). The reason for that is that the required Perl modules
+# are included on Windows/ActivePerl 5.8.1+, so it's easier to use 
+# those than to install the ported Unix tools. (Note that if you're 
+# using scp to download the archive, external scp  binary is still 
+# used.) 
+# use_external_bins = 0
+
+
+# Temporary directory to use. This directory must exist when starting and
+# Oinkmaster will then create a temporary sub directory in here.
+# Keep it as a #comment if you want to use the default.
+# The default will be checked for in the environment variables TMP,
+# TMPDIR or TEMPDIR, or otherwise use "/tmp" if none of them was set.
+
+# Example for UNIX.
+# tmpdir = /home/oinkmaster/tmp/
+
+# Example if running native Win32 or Cygwin.
+# tmpdir = c:\tmp
+
+# Example if running Cygwin and you prefer Cygwin style path.
+# tmpdir = /cygdrive/c/tmp
+
+
+# The umask to use during execution if you want it to be something
+# else than the current value when starting Oinkmaster.
+# This will affect the mode bits when writing new files.
+# Keep it commented out to keep your system's current umask.
+# umask = 0027
+
+
+# Files in the archive(s) matching this regular expression will be 
+# checked for changes, and then updated or added if needed.
+# All other files will be ignored. You can then choose to skip
+# individual files by specifying the "skipfile" keyword below.
+# Normally you shouldn't need to change this one.
+update_files = \.rules$|\.config$|\.conf$|\.txt$|\.map$
+
+
+# Regexp of keywords that starts a Snort rule.
+# May be useful if you create your own ruletypes and want those
+# lines to be regarded as rules as well.
+# rule_actions = alert|drop|log|pass|reject|sdrop|activate|dynamic
+
+
+# If the number of rules files in the downloaded archive matching the
+# 'update_files' regexp is below min_files, or if the number
+# of rules is below min_rules, the rules are regarded as broken
+# and the update is aborted with an error message.
+# Both are set to 1 by default (i.e. the archive is only regarded as
+# broken if it's totally empty).
+# If you download from multiple URLs, the count is the total number
+# of files/rules across all archives.
+# min_files = 1
+# min_rules = 1
+
+
+# By default, a basic sanity check is performed on most paths/filenames 
+# to see if they contain illegal characters that may screw things up. 
+# If this check is too strict for your system (e.g. you get bogus 
+# "illegal characters in filename" errors because of your local language 
+# etc) and you're sure you want to disable the checks completely,
+# set use_path_checks to 0.
+# use_path_checks = 1
+
+
+# If you want Oinkmaster to send a User-Agent HTTP header string
+# other than the default one for wget/LWP, set this variable.
+# user_agent = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
+
+
+# You can include other files anywhere in here by using
+# "include <file>". <file> will be parsed just like a regular 
+# oinkmaster.conf as soon as the include statement is seen, and then 
+# return and continue parsing the rest of the original file. If an 
+# option is redefined, it will override the previous value. You can use 
+# as many "include" statements as you wish, and also include even more 
+# files from included files. Example to load stuff from "/etc/foo.conf".
+# include /etc/foo.conf
+
+
+
+#######################################################################
+# Files to totally skip (i.e. never update or check for changes)      #
+#                                                                     #
+# Syntax: skipfile filename                                           #
+# or:     skipfile filename1, filename2, filename3, ...               #
+#######################################################################
+
+# Ignore local.rules from the rules archive by default since we might 
+# have put some local rules in our own local.rules and we don't want it 
+# to get overwritten by the empty one from the archive after each 
+# update.
+skipfile local.rules
+
+# The file deleted.rules contains rules that have been deleted from 
+# other files, so there is usually no point in updating it.
+skipfile deleted.rules
+
+# Also skip snort.conf by default since we don't want to overwrite our 
+# own snort.conf if we have it in the same directory as the rules. If 
+# you have your own production copy of snort.conf in another directory, 
+# it may be really nice to check for changes in this file though, 
+# especially since variables are sometimes added or modified and 
+# new/old files are included/excluded.
+skipfile snort.conf
+
+# You may want to consider ignoring threshold.conf for the same reasons 
+# as for snort.conf, i.e. if you customize it locally and don't want it 
+# to become overwritten by the default one. It may be better to put 
+# local thresholding/suppressing in some local file and still update 
+# and use the official one though, in case important stuff is added to 
+# it some day. We do update it by default, but it's your call.
+# skipfile threshold.conf
+
+# If you update from multiple URLs at the same time you may need to 
+# ignore the sid-msg.map (and generate it yourself if you need one) as 
+# it's usually included in each rules tarball. See the FAQ for more info.
+# skipfile sid-msg.map
+
+
+
+##########################################################################
+# SIDs to modify after each update (only for the skilled/stupid/brave).  #
+# Don't use it unless you have to. There is nothing that stops you from  #
+# modifying rules in such ways that they become invalid or generally     #
+# break things. You have been warned.                                    #
+# If you just want to disable SIDs, please skip this section and have a  #
+# look at the "disablesid" keyword below.                                #
+#                                                                        #
+# You may specify multiple modifysid directives for the same SID (they   #
+# will be processed in order of appearance), and you may also specify a  #
+# list of SIDs on which the substitution should be applied.              #
+# If the argument is in the form something.something it's regarded       #
+# as a filename and the substitution will apply on all rules in that     #
+# file. The wildcard ("*") can be used to apply the substitution on all  #
+# rules regardless of the SID or file. Please avoid using #comments      #
+# at the end of modifysid lines, they may confuse the parser in some     #
+# situations.                                                            #
+#                                                                        #
+# Syntax:                                                                #
+#   modifysid SID "replacethis" | "withthis"                             #    
+# or:                                                                    #
+#   modifysid SID1, SID2, SID3, ... "replacethis" | "withthis"           #
+# or:                                                                    #
+#   modifysid file "replacethis" | "withthis"                            #    
+# or:                                                                    #
+#   modifysid * "replacethis" | "withthis"                               #
+#                                                                        #
+# The strings within the quotes will basically be passed to a            #
+# s/replacethis/withthis/ statement in Perl, so they must be valid       #
+# regular expressions. The strings are case-insensitive and only the     #
+# first occurrence will be replaced. If there are multiple occurrences   #
+# you want to replace, simply repeat the same modifysid line.            #
+# As the strings are regular expressions, you MUST escape special        #
+# characters like $ \ / ( ) | by prepending a "\" to them.               #
+#                                                                        #
+# If you specify a modifysid statement for a multi-line rule, Oinkmaster #
+# will first translate the rule into a single-line version and then      #
+# perform the substitution, so you don't have to care about the trailing #
+# backslashes and newlines.                                              #
+#                                                                        #
+# If you use backreference variables in the substitution expression,     #
+# it's strongly recommended to specify them as ${1} instead of $1 and so #
+# on, to avoid parsing confusion with unexpected results in some         #
+# situations. Note that modifysid statements will process both active    #
+# and inactive (disabled) rules.                                         #
+#                                                                        #
+# You may want to check out README.templates and template-examples.conf  #
+# to find how you can simplify the modifysid usage by using templates.   #
+##########################################################################
+
+# Example to enable a rule (in this case SID 1325) that is disabled by
+# default, by simply replacing leading "#alert" with "alert".
+# (You should really use 'enablesid' for this though.)
+# Oinkmaster removes whitespaces next to the leading "#" so you don't
+# have to worry about that, but be careful about possible whitespace in
+# other places when writing the regexps.
+# modifysid 1325 "^#alert" | "alert"
+
+# You could also do this to enable it no matter what type of rule it is
+# (alert, log, pass, etc).
+# modifysid 1325 "^#" | ""
+
+# Example to add "tag" stuff to SID 1325.
+# modifysid 1325 "sid:1325;" | "sid:1325; tag: host, src, 300, seconds;"
+
+# Example to make SID 1378 a 'drop' rule (valid if you're running 
+# Snort_inline).
+# modifysid 1378 "^alert" | "drop"
+
+# Example to replace first occurrence of $EXTERNAL_NET with $HOME_NET 
+# in SID 302.
+# modifysid 302 "\$EXTERNAL_NET" | "\$HOME_NET"
+
+# You can also specify that a substitution should apply on multiple SIDs.
+# modifysid 302,429,1821 "\$EXTERNAL_NET" | "\$HOME_NET"
+
+# You can take advantage of the fact that it's regular expressions and
+# do more complex stuff. This example (for Snort_inline) adds a 'replace'
+# statement to SID 1324 that replaces "/bin/sh" with "/foo/sh".
+# modifysid 1324 "(content\s*:\s*"\/bin\/sh"\s*;)" | \
+#                "${1} replace:"\/foo\/sh";"
+
+# If you for some reason would like to add a comment inside the actual 
+# rules file, like the reason why you disabled this rule, you can do 
+# like this (you would normally add such comments in oinkmaster.conf 
+# though).
+# modifysid 1324 "(.+)" | "# 20020101: disabled this rule just for fun:\n#${1}"
+
+# Here is an example that is actually useful. Let's say you don't care 
+# about incoming welchia pings (detected by SID 483 at the time of 
+# writing) but you want to know when infected hosts on your network 
+# scans hosts on the outside. (Remember that watching for outgoing 
+# malicious packets is often just as important as watching for incoming 
+# ones, especially in this case.) The rule currently looks like
+# "alert icmp $EXTERNAL_NET any -> $HOME_NET any ..."
+# but we want to switch that so it becomes
+# "alert icmp $HOME_NET any -> $EXTERNAL_NET any ...".
+# Here is how it could be done.
+# modifysid 483 \
+# "(.+) \$EXTERNAL_NET (.+) \$HOME_NET (.+)" | \
+# "${1} \$HOME_NET ${2} \$EXTERNAL_NET ${3}"
+
+# The wildcard (modifysid * ...) can be used to do all kinds of 
+# interesting things. The substitution expression will be applied on all 
+# matching rules. First, a silly example to replace "foo" with "bar" in 
+# all rules (that have the string "foo" in them, that is.) 
+# modifysid * "foo" | "bar"
+
+# If you for some reason don't want to use the stream preprocessor to 
+# match established streams, you may want to replace the 'flow' 
+# statement with 'flags:A+;' in all those rules.
+# modifysid * "flow:[a-z,_ ]+;" | "flags:A+;"
+
+# Example to convert all rules of classtype attempted-admin to 'drop' 
+# rules (for Snort_inline only, obviously).
+# modifysid * "^alert (.*classtype\s*:\s*attempted-admin)" | "drop ${1}"
+
+# This one will append some text to the 'msg' string for all rules that 
+# have the 'tag' keyword in them.
+# modifysid * "(.*msg:\s*".+?)"(\s*;.+;\s*tag:.*)" | \
+#             "${1}, going to tag this baby"${2}"
+
+# There may be times when you want to replace multiple occurrences of a 
+# certain keyword/string in a rule and not just the first one. To 
+# replace the first two occurrences of "foo" with "bar" in SID 100, 
+# simply repeat the modifysid statement:
+# modifysid 100 "foo" | "bar"
+# modifysid 100 "foo" | "bar"
+ 
+# Or you can even specify a SID list but repeat the same SID as many 
+# times as required, like:
+# modifysid 100,100,100 "foo" | "bar"
+
+# Enable all rules in the file exploit.rules.
+# modifysid exploit.rules "^#" | ""
+
+# Enable all rules in exploit.rules, icmp-info.rules and also SID 1171.
+# modifysid exploit.rules, snmp.rules, 1171 "^#" | ""
+
+
+
+########################################################################
+# SIDs that we don't want to update.                                   #
+# If you for some reason don't want a specific rule to be updated      #
+# (e.g. you made local modifications to it and you never want to       #
+# update it and don't care about changes in the official version), you #
+# can specify a "localsid" statement for it. This means that the old   #
+# version of the rule (i.e. the one in the rules file on your          #
+# harddrive) is always kept, regardless if the official version has    #
+# been updated. Please do not use this feature unless in special       #
+# cases as it's easy to end up with many signatures that aren't        #
+# maintained anymore. See the FAQ for details about this and hints     #
+# about better solutions regarding customization of rules.             #
+#                                                                      #
+# Syntax:  localsid SID                                                #
+# or:      localsid SID1, SID2, SID3, ...                              #
+########################################################################
+
+# Example to never update SID 1325.
+# localsid 1325
+
+
+
+########################################################################
+# SIDs to enable after each update.                                    #
+# Will simply remove all the leading '#' for a specified SID (if it's  #
+# a multi-line rule, the leading '#' for all lines are removed.)       #
+# These will be processed after all the modifysid and disablesid       #
+# statements. Using 'enablesid' on a rule that is not disabled is a    #
+# NOOP.                                                                #
+#                                                                      #
+# Syntax:  enablesid SID                                               #
+# or:      enablesid SID1, SID2, SID3, ...                             #
+########################################################################
+
+# Example to enable SID 1325.
+# enablesid 1325
+
+
+
+########################################################################
+# SIDs to comment out, i.e. disable, after each update by placing a    #
+# '#' in front of the rule (if it's a multi-line rule, it will be put  #
+# in front of all lines).                                              #
+#                                                                      #
+# Syntax:  disablesid SID                                              #
+# or:      disablesid SID1, SID2, SID3, ...                            #
+########################################################################
+
+# You can specify one SID per line.
+# disablesid 1
+# disablesid 2
+# disablesid 3
+
+# And also as comma-separated lists.
+# disablesid 4,5,6
+
+# It's a good idea to also add comment about why you disable the sid:
+# disablesid 1324    # 20020101: disabled this SID just because I can

roles/Sharingan/files/oinkmaster/oinkmaster.conf

@@ -0,0 +1,425 @@
+# $Id: oinkmaster.conf,v 1.132 2006/02/02 12:05:08 andreas_o Exp $ #
+
+# This file is pretty big by default, but don't worry. 
+# The only things required are "path" and "update_files". You must also 
+# set "url" to point to the correct rules archive for your version of 
+# Snort, unless you prefer to specify this on the command line.
+# The rest in here is just a few recommended defaults, and examples
+# how to use all the other optional features and give some ideas how they 
+# could be used.
+
+# Remember not to let untrusted users edit Oinkmaster configuration
+# files, as things like the PATH to use during execution is defined
+# in here.
+
+
+
+# Use "url = <url>" to specify the location of the rules archive to 
+# download. The url must begin with http://, https://, ftp://, file:// 
+# or scp:// and end with .tar.gz or .tgz, and the file must be a 
+# gzipped tarball what contains a directory named "rules".
+# You can also point to a local directory with dir://<directory>.
+# Multiple "url = <url>" lines can be specified to grab multiple rules
+# archives from different locations.
+#
+# Note: if URL is specified on the command line, it overrides all 
+#       possible URLs specified in the configuration file(s).
+#
+# The location of the official Snort rules you should use depends
+# on which Snort version you run. Basically, you should go to
+# http://www.snort.org/rules/ and follow the instructions
+# there to pick the right URL for your version of Snort
+# (and remember to update the URL when upgrading Snort in the
+# future). You can of course also specify locations to third party 
+# rules.
+#
+# As of March 2005, you must register on the Snort site to get access 
+# to the official Snort rules. This will get you an "oinkcode".
+# You then specify the URL as
+# http://www.snort.org/pub-bin/oinkmaster.cgi/<oinkcode>/<filename>
+# For example, if your code is 5a081649c06a277e1022e1284b and
+# you use Snort 2.4, the url to use would be (without the wrap):
+# http://www.snort.org/pub-bin/oinkmaster.cgi/
+# 5a081649c06a277e1022e1284bdc8fabda70e2a4/snortrules-snapshot-2.4.tar.gz
+# See the Oinkmaster FAQ Q1 and http://www.snort.org/rules/ for
+# more information.
+
+
+# URL examples follows. Replace <oinkcode> with the code you get on the 
+# Snort site in your registered user profile.
+
+# Example for Snort
+# url = http://www.snort.org/pub-bin/oinkmaster.cgi/157f1670c58caa1bcb3e4de0d68e96c7e12a08ca/snortrules-snapshot-2976.tar.gz
+
+# Suricata
+ url = http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz
+
+# Example for Community rules
+# url = http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules.tar.gz
+
+# Example for rules from the Bleeding Snort project
+# url = http://www.bleedingsnort.com/bleeding.rules.tar.gz
+
+# If you prefer to download the rules archive from outside Oinkmaster,
+# you can then point to the file on your local filesystem by using
+# file://<filename>, for example:
+# url = file:///tmp/snortrules.tar.gz
+
+# In rare cases you may want to grab the rules directly from a
+# local directory (don't confuse this with the output directory).
+# url = dir:///etc/snort/src/rules
+
+# Example to use scp to copy the rules archive from another host.
+# Only OpenSSH is tested. See the FAQ for more information.
+# url = scp://user@somehost.example.com:/somedir/snortrules.tar.gz
+
+# If you use -u scp://... and need to specify a private ssh key (passed 
+# as -i <key> to the scp command) you can specify it here or add an 
+# entry in ~/.ssh/config for the Oinkmaster user as described in the 
+# OpenSSH manual. 
+# scp_key = /home/oinkmaster/oinkmaster_privkey
+
+
+# The PATH to use during execution. If you prefer to use external 
+# binaries (i.e. use_external_bins=1, see below), tar and gzip must be 
+# found, and also wget if downloading via ftp, http or https. All with 
+# optional .exe suffix. If you're on Cygwin, make sure that the path 
+# contains the Cygwin binaries and not the native Win32 binaries or 
+# you will get problems.
+# Assume UNIX style by default:
+path = /bin:/usr/bin:/usr/local/bin
+
+# Example if running native Win32 or standalone Cygwin:
+# path = c:\oinkmaster;c:\oinkmaster\bin
+
+# Example if running standalone Cygwin and you prefer Cygwin style path:
+# path = /cygdrive/c/oinkmaster:/cygdrive/c/oinkmaster/bin
+
+
+# We normally use external binaries (wget, tar and gzip) since they're 
+# already available on most systems and do a good job. If you have the 
+# Perl modules Archive::Tar, IO::Zlib and LWP::UserAgent, you can use
+# those instead if you like. You can set use_external_bins below to 
+# choose which method you prefer. It's set to 0 by default on Win32 
+# (i.e. use Perl modules), and 1 on other systems (i.e. use external 
+# binaries). The reason for that is that the required Perl modules
+# are included on Windows/ActivePerl 5.8.1+, so it's easier to use 
+# those than to install the ported Unix tools. (Note that if you're 
+# using scp to download the archive, external scp  binary is still 
+# used.) 
+# use_external_bins = 0
+
+
+# Temporary directory to use. This directory must exist when starting and
+# Oinkmaster will then create a temporary sub directory in here.
+# Keep it as a #comment if you want to use the default.
+# The default will be checked for in the environment variables TMP,
+# TMPDIR or TEMPDIR, or otherwise use "/tmp" if none of them was set.
+
+# Example for UNIX.
+# tmpdir = /home/oinkmaster/tmp/
+
+# Example if running native Win32 or Cygwin.
+# tmpdir = c:\tmp
+
+# Example if running Cygwin and you prefer Cygwin style path.
+# tmpdir = /cygdrive/c/tmp
+
+
+# The umask to use during execution if you want it to be something
+# else than the current value when starting Oinkmaster.
+# This will affect the mode bits when writing new files.
+# Keep it commented out to keep your system's current umask.
+# umask = 0027
+
+
+# Files in the archive(s) matching this regular expression will be 
+# checked for changes, and then updated or added if needed.
+# All other files will be ignored. You can then choose to skip
+# individual files by specifying the "skipfile" keyword below.
+# Normally you shouldn't need to change this one.
+update_files = \.rules$|\.config$|\.conf$|\.txt$|\.map$
+
+
+# Regexp of keywords that starts a Snort rule.
+# May be useful if you create your own ruletypes and want those
+# lines to be regarded as rules as well.
+# rule_actions = alert|drop|log|pass|reject|sdrop|activate|dynamic
+
+
+# If the number of rules files in the downloaded archive matching the
+# 'update_files' regexp is below min_files, or if the number
+# of rules is below min_rules, the rules are regarded as broken
+# and the update is aborted with an error message.
+# Both are set to 1 by default (i.e. the archive is only regarded as
+# broken if it's totally empty).
+# If you download from multiple URLs, the count is the total number
+# of files/rules across all archives.
+# min_files = 1
+# min_rules = 1
+
+
+# By default, a basic sanity check is performed on most paths/filenames 
+# to see if they contain illegal characters that may screw things up. 
+# If this check is too strict for your system (e.g. you get bogus 
+# "illegal characters in filename" errors because of your local language 
+# etc) and you're sure you want to disable the checks completely,
+# set use_path_checks to 0.
+# use_path_checks = 1
+
+
+# If you want Oinkmaster to send a User-Agent HTTP header string
+# other than the default one for wget/LWP, set this variable.
+# user_agent = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
+
+
+# You can include other files anywhere in here by using
+# "include <file>". <file> will be parsed just like a regular 
+# oinkmaster.conf as soon as the include statement is seen, and then 
+# return and continue parsing the rest of the original file. If an 
+# option is redefined, it will override the previous value. You can use 
+# as many "include" statements as you wish, and also include even more 
+# files from included files. Example to load stuff from "/etc/foo.conf".
+# include /etc/foo.conf
+
+
+
+#######################################################################
+# Files to totally skip (i.e. never update or check for changes)      #
+#                                                                     #
+# Syntax: skipfile filename                                           #
+# or:     skipfile filename1, filename2, filename3, ...               #
+#######################################################################
+
+# Ignore local.rules from the rules archive by default since we might 
+# have put some local rules in our own local.rules and we don't want it 
+# to get overwritten by the empty one from the archive after each 
+# update.
+skipfile local.rules
+
+# The file deleted.rules contains rules that have been deleted from 
+# other files, so there is usually no point in updating it.
+skipfile deleted.rules
+
+# Also skip snort.conf by default since we don't want to overwrite our 
+# own snort.conf if we have it in the same directory as the rules. If 
+# you have your own production copy of snort.conf in another directory, 
+# it may be really nice to check for changes in this file though, 
+# especially since variables are sometimes added or modified and 
+# new/old files are included/excluded.
+skipfile snort.conf
+
+# You may want to consider ignoring threshold.conf for the same reasons 
+# as for snort.conf, i.e. if you customize it locally and don't want it 
+# to become overwritten by the default one. It may be better to put 
+# local thresholding/suppressing in some local file and still update 
+# and use the official one though, in case important stuff is added to 
+# it some day. We do update it by default, but it's your call.
+# skipfile threshold.conf
+
+# If you update from multiple URLs at the same time you may need to 
+# ignore the sid-msg.map (and generate it yourself if you need one) as 
+# it's usually included in each rules tarball. See the FAQ for more info.
+# skipfile sid-msg.map
+
+
+
+##########################################################################
+# SIDs to modify after each update (only for the skilled/stupid/brave).  #
+# Don't use it unless you have to. There is nothing that stops you from  #
+# modifying rules in such ways that they become invalid or generally     #
+# break things. You have been warned.                                    #
+# If you just want to disable SIDs, please skip this section and have a  #
+# look at the "disablesid" keyword below.                                #
+#                                                                        #
+# You may specify multiple modifysid directives for the same SID (they   #
+# will be processed in order of appearance), and you may also specify a  #
+# list of SIDs on which the substitution should be applied.              #
+# If the argument is in the form something.something it's regarded       #
+# as a filename and the substitution will apply on all rules in that     #
+# file. The wildcard ("*") can be used to apply the substitution on all  #
+# rules regardless of the SID or file. Please avoid using #comments      #
+# at the end of modifysid lines, they may confuse the parser in some     #
+# situations.                                                            #
+#                                                                        #
+# Syntax:                                                                #
+#   modifysid SID "replacethis" | "withthis"                             #    
+# or:                                                                    #
+#   modifysid SID1, SID2, SID3, ... "replacethis" | "withthis"           #
+# or:                                                                    #
+#   modifysid file "replacethis" | "withthis"                            #    
+# or:                                                                    #
+#   modifysid * "replacethis" | "withthis"                               #
+#                                                                        #
+# The strings within the quotes will basically be passed to a            #
+# s/replacethis/withthis/ statement in Perl, so they must be valid       #
+# regular expressions. The strings are case-insensitive and only the     #
+# first occurrence will be replaced. If there are multiple occurrences   #
+# you want to replace, simply repeat the same modifysid line.            #
+# As the strings are regular expressions, you MUST escape special        #
+# characters like $ \ / ( ) | by prepending a "\" to them.               #
+#                                                                        #
+# If you specify a modifysid statement for a multi-line rule, Oinkmaster #
+# will first translate the rule into a single-line version and then      #
+# perform the substitution, so you don't have to care about the trailing #
+# backslashes and newlines.                                              #
+#                                                                        #
+# If you use backreference variables in the substitution expression,     #
+# it's strongly recommended to specify them as ${1} instead of $1 and so #
+# on, to avoid parsing confusion with unexpected results in some         #
+# situations. Note that modifysid statements will process both active    #
+# and inactive (disabled) rules.                                         #
+#                                                                        #
+# You may want to check out README.templates and template-examples.conf  #
+# to find how you can simplify the modifysid usage by using templates.   #
+##########################################################################
+
+# Example to enable a rule (in this case SID 1325) that is disabled by
+# default, by simply replacing leading "#alert" with "alert".
+# (You should really use 'enablesid' for this though.)
+# Oinkmaster removes whitespaces next to the leading "#" so you don't
+# have to worry about that, but be careful about possible whitespace in
+# other places when writing the regexps.
+# modifysid 1325 "^#alert" | "alert"
+
+# You could also do this to enable it no matter what type of rule it is
+# (alert, log, pass, etc).
+# modifysid 1325 "^#" | ""
+
+# Example to add "tag" stuff to SID 1325.
+# modifysid 1325 "sid:1325;" | "sid:1325; tag: host, src, 300, seconds;"
+
+# Example to make SID 1378 a 'drop' rule (valid if you're running 
+# Snort_inline).
+# modifysid 1378 "^alert" | "drop"
+
+# Example to replace first occurrence of $EXTERNAL_NET with $HOME_NET 
+# in SID 302.
+# modifysid 302 "\$EXTERNAL_NET" | "\$HOME_NET"
+
+# You can also specify that a substitution should apply on multiple SIDs.
+# modifysid 302,429,1821 "\$EXTERNAL_NET" | "\$HOME_NET"
+
+# You can take advantage of the fact that it's regular expressions and
+# do more complex stuff. This example (for Snort_inline) adds a 'replace'
+# statement to SID 1324 that replaces "/bin/sh" with "/foo/sh".
+# modifysid 1324 "(content\s*:\s*"\/bin\/sh"\s*;)" | \
+#                "${1} replace:"\/foo\/sh";"
+
+# If you for some reason would like to add a comment inside the actual 
+# rules file, like the reason why you disabled this rule, you can do 
+# like this (you would normally add such comments in oinkmaster.conf 
+# though).
+# modifysid 1324 "(.+)" | "# 20020101: disabled this rule just for fun:\n#${1}"
+
+# Here is an example that is actually useful. Let's say you don't care 
+# about incoming welchia pings (detected by SID 483 at the time of 
+# writing) but you want to know when infected hosts on your network 
+# scans hosts on the outside. (Remember that watching for outgoing 
+# malicious packets is often just as important as watching for incoming 
+# ones, especially in this case.) The rule currently looks like
+# "alert icmp $EXTERNAL_NET any -> $HOME_NET any ..."
+# but we want to switch that so it becomes
+# "alert icmp $HOME_NET any -> $EXTERNAL_NET any ...".
+# Here is how it could be done.
+# modifysid 483 \
+# "(.+) \$EXTERNAL_NET (.+) \$HOME_NET (.+)" | \
+# "${1} \$HOME_NET ${2} \$EXTERNAL_NET ${3}"
+
+# The wildcard (modifysid * ...) can be used to do all kinds of 
+# interesting things. The substitution expression will be applied on all 
+# matching rules. First, a silly example to replace "foo" with "bar" in 
+# all rules (that have the string "foo" in them, that is.) 
+# modifysid * "foo" | "bar"
+
+# If you for some reason don't want to use the stream preprocessor to 
+# match established streams, you may want to replace the 'flow' 
+# statement with 'flags:A+;' in all those rules.
+# modifysid * "flow:[a-z,_ ]+;" | "flags:A+;"
+
+# Example to convert all rules of classtype attempted-admin to 'drop' 
+# rules (for Snort_inline only, obviously).
+# modifysid * "^alert (.*classtype\s*:\s*attempted-admin)" | "drop ${1}"
+
+# This one will append some text to the 'msg' string for all rules that 
+# have the 'tag' keyword in them.
+# modifysid * "(.*msg:\s*".+?)"(\s*;.+;\s*tag:.*)" | \
+#             "${1}, going to tag this baby"${2}"
+
+# There may be times when you want to replace multiple occurrences of a 
+# certain keyword/string in a rule and not just the first one. To 
+# replace the first two occurrences of "foo" with "bar" in SID 100, 
+# simply repeat the modifysid statement:
+# modifysid 100 "foo" | "bar"
+# modifysid 100 "foo" | "bar"
+ 
+# Or you can even specify a SID list but repeat the same SID as many 
+# times as required, like:
+# modifysid 100,100,100 "foo" | "bar"
+
+# Enable all rules in the file exploit.rules.
+# modifysid exploit.rules "^#" | ""
+
+# Enable all rules in exploit.rules, icmp-info.rules and also SID 1171.
+# modifysid exploit.rules, snmp.rules, 1171 "^#" | ""
+
+
+
+########################################################################
+# SIDs that we don't want to update.                                   #
+# If you for some reason don't want a specific rule to be updated      #
+# (e.g. you made local modifications to it and you never want to       #
+# update it and don't care about changes in the official version), you #
+# can specify a "localsid" statement for it. This means that the old   #
+# version of the rule (i.e. the one in the rules file on your          #
+# harddrive) is always kept, regardless if the official version has    #
+# been updated. Please do not use this feature unless in special       #
+# cases as it's easy to end up with many signatures that aren't        #
+# maintained anymore. See the FAQ for details about this and hints     #
+# about better solutions regarding customization of rules.             #
+#                                                                      #
+# Syntax:  localsid SID                                                #
+# or:      localsid SID1, SID2, SID3, ...                              #
+########################################################################
+
+# Example to never update SID 1325.
+# localsid 1325
+
+
+
+########################################################################
+# SIDs to enable after each update.                                    #
+# Will simply remove all the leading '#' for a specified SID (if it's  #
+# a multi-line rule, the leading '#' for all lines are removed.)       #
+# These will be processed after all the modifysid and disablesid       #
+# statements. Using 'enablesid' on a rule that is not disabled is a    #
+# NOOP.                                                                #
+#                                                                      #
+# Syntax:  enablesid SID                                               #
+# or:      enablesid SID1, SID2, SID3, ...                             #
+########################################################################
+
+# Example to enable SID 1325.
+# enablesid 1325
+
+
+
+########################################################################
+# SIDs to comment out, i.e. disable, after each update by placing a    #
+# '#' in front of the rule (if it's a multi-line rule, it will be put  #
+# in front of all lines).                                              #
+#                                                                      #
+# Syntax:  disablesid SID                                              #
+# or:      disablesid SID1, SID2, SID3, ...                            #
+########################################################################
+
+# You can specify one SID per line.
+# disablesid 1
+# disablesid 2
+# disablesid 3
+
+# And also as comma-separated lists.
+# disablesid 4,5,6
+
+# It's a good idea to also add comment about why you disable the sid:
+# disablesid 1324    # 20020101: disabled this SID just because I can

roles/Sharingan/files/oinkmaster/oinkmaster.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Darebee Notifier for AniNIX Martial Arts
+
+[Service]
+Nice=19
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+Type=simple
+ExecStart=/home/DarkFeather/bin/darebee-notifier
+
+#EOF

roles/Sharingan/files/oinkmaster/oinkmaster.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Sharingan-IDS | oinkmaster timer
+
+[Timer]
+OnCalendar=05:00
+Persistent=false
+
+[Install]
+WantedBy=timers.target
+
+#EOF

roles/Sharingan/files/rkhunter/rkhunter.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Sharingan-IDS | rkhunter HIDS
+
+[Service]
+Nice=19
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+Type=simple
+ExecStart=rkhunter --check --sk
+User=root
+group=root
+
+[Install]
+WantedBy=multi-user.target

roles/Sharingan/files/rkhunter/rkhunter.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Sharingan-IDS | rkhunter timer
+
+[Timer]
+OnCalendar=15:00
+Persistent=false
+
+[Install]
+WantedBy=timers.target
+
+#EOF

roles/Sharingan/files/sharingan-heartbeat.service

@@ -2,7 +2,7 @@
 Description=AniNIX/Sharingan | Heartbeat service
 
 [Service]
-ExecStart=/usr/sbin/systemctl is-system-running
+ExecStart=/bin/bash -c 'systemd-cat -t sharingan-heartbeat echo `systemctl is-system-running`'
 Type=oneshot
 RemainAfterExit=no
 User=root

roles/Sharingan/files/sshguard.conf

@@ -0,0 +1,4 @@
+LOGREADER="LANG=C /usr/bin/journalctl -afb -p info -n1 -t sshd -o cat"
+BLACKLIST_FILE=120:/var/db/sshguard/blacklist.db
+BACKEND="/usr/lib/sshguard/sshg-fw-iptables"
+WHITELIST_FILE=/etc/sshguard.whitelist

roles/Sharingan/files/suricata/classification.config

@@ -0,0 +1,68 @@
+# $Id$
+# classification.config taken from Snort 2.8.5.3. Snort is governed by the GPLv2
+#
+# The following includes information for prioritizing rules
+#
+# Each classification includes a shortname, a description, and a default
+# priority for that classification.
+#
+# This allows alerts to be classified and prioritized.  You can specify
+# what priority each classification has.  Any rule can override the default
+# priority for that rule.
+#
+# Here are a few example rules:
+#
+#   alert TCP any any -> any 80 (msg: "EXPLOIT ntpdx overflow";
+#	dsize: > 128; classtype:attempted-admin; priority:10;
+#
+#   alert TCP any any -> any 25 (msg:"SMTP expn root"; flags:A+; \
+#	      content:"expn root"; nocase; classtype:attempted-recon;)
+#
+# The first rule will set its type to "attempted-admin" and override
+# the default priority for that type to 10.
+#
+# The second rule set its type to "attempted-recon" and set its
+# priority to the default for that type.
+#
+
+#
+# config classification:shortname,short description,priority
+#
+
+config classification: not-suspicious,Not Suspicious Traffic,3
+config classification: unknown,Unknown Traffic,3
+config classification: bad-unknown,Potentially Bad Traffic, 2
+config classification: attempted-recon,Attempted Information Leak,2
+config classification: successful-recon-limited,Information Leak,2
+config classification: successful-recon-largescale,Large Scale Information Leak,2
+config classification: attempted-dos,Attempted Denial of Service,2
+config classification: successful-dos,Denial of Service,2
+config classification: attempted-user,Attempted User Privilege Gain,1
+config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1
+config classification: successful-user,Successful User Privilege Gain,1
+config classification: attempted-admin,Attempted Administrator Privilege Gain,1
+config classification: successful-admin,Successful Administrator Privilege Gain,1
+
+
+# NEW CLASSIFICATIONS
+config classification: rpc-portmap-decode,Decode of an RPC Query,2
+config classification: shellcode-detect,Executable code was detected,1
+config classification: string-detect,A suspicious string was detected,3
+config classification: suspicious-filename-detect,A suspicious filename was detected,2
+config classification: suspicious-login,An attempted login using a suspicious username was detected,2
+config classification: system-call-detect,A system call was detected,2
+config classification: tcp-connection,A TCP connection was detected,4
+config classification: trojan-activity,A Network Trojan was detected, 1
+config classification: unusual-client-port-connection,A client was using an unusual port,2
+config classification: network-scan,Detection of a Network Scan,3
+config classification: denial-of-service,Detection of a Denial of Service Attack,2
+config classification: non-standard-protocol,Detection of a non-standard protocol or event,2
+config classification: protocol-command-decode,Generic Protocol Command Decode,3
+config classification: web-application-activity,access to a potentially vulnerable web application,2
+config classification: web-application-attack,Web Application Attack,1
+config classification: misc-activity,Misc activity,3
+config classification: misc-attack,Misc Attack,2
+config classification: icmp-event,Generic ICMP event,3
+config classification: kickass-porn,SCORE! Get the lotion!,1
+config classification: policy-violation,Potential Corporate Privacy Violation,1
+config classification: default-login-attempt,Attempt to login by a default username and password,2

roles/Sharingan/files/suricata/local.rules

@@ -0,0 +1,11 @@
+pass ip 10.0.1.2/32 445 <> 10.0.1.3 any (msg: "Ignore Microsoft-ds traffic"; sid:4294967202;)
+pass dns $HOME_NET any -> 10.0.1.3 53 (msg: "Ignore false malformed DNS from DD-WRT"; sid:4294967204;)
+pass ip any any <> 96.126.111.217 6667 (msg: "We consider Xertion safe"; sid:4294967205;)
+pass tcp $HOME_NET any <> 10.0.1.3 any (msg: "Allow AniNIX::Core to scan"; sid:4294967206;)
+pass http 10.0.1.3 any -> $HOME_NET any (msg: "Pass local http traffic."; sid:4294967208;)
+pass tcp 10.0.1.3 any -> 10.0.1.1 80 (msg: "Allow Core to admin Shadowfeed with Geth integration"; sid:4294967209;)
+pass tcp 10.0.1.3 any -> $HOME_NET 3389 (msg:"ET DOS Microsoft Remote Desktop (RDP) Syn then Reset 30 Second DoS Attempt"; flags:R; flow:to_server; flowbits:isset,ms.rdp.synack; flowbits:isnotset,ms.rdp.established; flowbits:unset,ms.rdp.synack; reference:cve,2012-0152; classtype:attempted-dos; sid:4294967211;)
+pass http $HOME_NET any -> any any (msg:"ET POLICY curl User-Agent Outbound"; sid:4294967212; content:"curl/"; nocase; http_user_agent; depth:5;)
+pass udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT ping request"; content:"d1|3a|ad2|3a|id20|3a|"; depth:12; nocase; sid:4294967213;)
+pass ip $HOME_NET any -> [130.239.18.119,162.213.39.42,185.30.166.37,185.30.166.38,38.229.70.22,64.86.243.181] any (msg:"130.239.18.119|162.213.39.42|185.30.166.37|185.30.166.38|38.229.70.22|64.86.243.181"; rev:2; sid:4294967214; classtype:trojan-activity;)
+pass tls any any -> any any (msg:"SURICATA TLS invalid handshake message"; flow:established; app-layer-event:tls.invalid_handshake_message; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:4294967215; rev:1;)

roles/Sharingan/files/suricata/reference.config

@@ -0,0 +1,26 @@
+# config reference: system URL
+
+config reference: bugtraq   http://www.securityfocus.com/bid/
+config reference: bid	    http://www.securityfocus.com/bid/
+config reference: cve       http://cve.mitre.org/cgi-bin/cvename.cgi?name=
+#config reference: cve       http://cvedetails.com/cve/
+config reference: secunia   http://www.secunia.com/advisories/
+
+#whitehats is unfortunately gone
+config reference: arachNIDS http://www.whitehats.com/info/IDS
+
+config reference: McAfee    http://vil.nai.com/vil/content/v_
+config reference: nessus    http://cgi.nessus.org/plugins/dump.php3?id=
+config reference: url       http://
+config reference: et        http://doc.emergingthreats.net/
+config reference: etpro     http://doc.emergingthreatspro.com/
+config reference: telus     http://
+config reference: osvdb     http://osvdb.org/show/osvdb/
+config reference: threatexpert http://www.threatexpert.com/report.aspx?md5=
+config reference: md5	    http://www.threatexpert.com/report.aspx?md5=
+config reference: exploitdb http://www.exploit-db.com/exploits/
+config reference: openpacket https://www.openpacket.org/capture/grab/
+config reference: securitytracker http://securitytracker.com/id?
+config reference: secunia   http://secunia.com/advisories/
+config reference: xforce    http://xforce.iss.net/xforce/xfdb/
+config reference: msft      http://technet.microsoft.com/security/bulletin/

roles/Sharingan/files/suricata/threshold.config

@@ -0,0 +1,69 @@
+# Configure Thresholding and Suppression
+# ======================================
+#
+# The threshold command is deprecated.  Use detection_filter for thresholds
+# within a rule and event_filter for standalone threshold configurations.
+# Please see README.filters for more information on filters.
+#
+# Thresholding:
+#
+# This feature is used to reduce the number of logged alerts for noisy rules.
+# This can be tuned to significantly reduce false alarms, and it can also be
+# used to write a newer breed of rules. Thresholding commands limit the number
+# of times a particular event is logged during a specified time interval.
+#
+# There are 3 types of event_filters:
+#
+# 1) Limit
+#    Alert on the 1st M events during the time interval, then ignore
+#    events for the rest of the time interval.
+#
+# 2) Threshold
+#    Alert every M times we see this event during the time interval.
+#
+# 3) Both
+#    Alert once per time interval after seeing M occurrences of the
+#    event, then ignore any additional events during the time interval.
+#
+# Threshold commands are formatted as:
+#
+# event_filter gen_id gen-id, sig_id sig-id, \
+#     type limit|threshold|both, track by_src|by_dst, \
+#     count n , seconds m
+#
+# Limit to logging 1 event per 60 seconds:
+#
+# event_filter gen_id 1, sig_id 1851, type limit, \
+#     track by_src, count 1, seconds 60
+#
+# Global Threshold - Limit to logging 1 event per 60 seconds per IP triggering
+# each rule (rules are gen_id 1):
+#
+# event_filter gen_id 1, sig_id 0, type limit, track by_src, count 1, seconds 60
+#
+# Global Threshold - Limit to logging 1 event per 60 seconds per IP triggering
+# any alert for any event generator:
+#
+# event_filter gen_id 0, sig_id 0, type limit, track by_src, count 1, seconds 60
+#
+# Suppression:
+#
+# Suppression commands are standalone commands that reference generators and
+# sids and IP addresses via a CIDR block (or IP list). This allows a rule to be
+# completely suppressed, or suppressed when the causitive traffic is going to
+# or comming from a specific IP or group of IP addresses.
+#
+# Suppress this event completely:
+#
+# suppress gen_id 1, sig_id 1852
+#
+# Suppress this event from this IP:
+#
+# suppress gen_id 1, sig_id 1852, track by_src, ip 10.1.1.54
+#
+# Suppress this event to this CIDR block:
+#
+# suppress gen_id 1, sig_id 1852, track by_dst, ip 10.1.1.0/24
+#
+# working example from iggbsd2 snort:
+#suppress gen_id 122, sig_id 17, track by_src, ip 172.16.0.2

roles/Sharingan/tasks/data.yml

@@ -1,5 +1,6 @@
 --- 
- - name: Sharingan data filers
+ 
+ - name: Sharingan data packages
    become: yes
    package:
      state: present
@@ -32,6 +33,7 @@
      owner: root
      group: root
      mode: 0750
+
  - name: Sharingan-Data service conf
    become: yes
    copy:
@@ -43,6 +45,7 @@
 
  - name: Sharingan-Data filer service
    become: yes
+   register: data_service
    copy:
      src: "sharingan-data.service/{{ ansible_os_family }}"
      dest: /usr/lib/systemd/system/sharingan-data.service
@@ -52,6 +55,7 @@
 
  - name: Sharingan-Eval service
    become: yes
+   register: eval_service
    copy:
      src: sharingan-eval.service
      dest: /usr/lib/systemd/system/sharingan-eval.service
@@ -102,14 +106,18 @@
      group: root
      mode: 0700
 
- - name: Sharingan-Data heartbeat service
+ - name: Sharingan-Heartbeat service
    become: yes
+   register: heartbeat_service
    copy:
-     src: sharingan-heartbeat.service
+     src: "{{ item }}"
      dest: /usr/lib/systemd/system
      owner: root
      group: root
      mode: 0750
+   loop: 
+     - sharingan-heartbeat.timer
+     - sharingan-heartbeat.service 
 
  - name: Sharingan-Data heartbeat timer
    become: yes
@@ -123,6 +131,7 @@
  - systemd:
      daemon_reload: yes
    become: yes
+   when: data_service.changed or eval_service.changed or heartbeat_service.changed
 
  - name: Start Sharingan-Data services
    become: yes

roles/Sharingan/tasks/ids.yml

@@ -0,0 +1,59 @@
+---
+
+ - name: sshguard package
+   become: yes
+   package:
+     name: 
+       - sshguard
+       - suricata
+       - oinkmaster
+     state: present
+
+ - name: sshguard config
+   become: yes
+   copy:
+     src: sshguard.conf
+     dest: /etc/sshguard.conf
+     owner: root
+     group: root
+     mode: 0600
+
+ - name: sshguard allowlist
+   become: yes
+   copy:
+     dest: /etc/sshguard.allowlist
+     content: |
+       "{{ router }}/{{ netmask }}"
+     owner: root
+     group: root
+     mode: 0600
+
+# - name: Copy oinkmaster service
+#   register: oinkmaster_service
+#   become: yes
+#   loop: 
+#     - oinkmaster.service
+#     - oinkmaster.timer
+#   copy:
+#     src: "{{ item }}"
+#     dest: "/usr/lib/systemd/system/{{ item }}"
+#     owner: root
+#     group: root
+#     mode: 0644
+#
+# - systemd:
+#     daemon_reload: yes
+#   become: yes
+#   when: oinkmaster_service.changed
+
+ - name: IDS services
+   become: yes
+   loop: 
+     - suricata.service
+     - sshguard.service
+       # - oinkmaster.timer
+   service: 
+     name: "{{ item }}"
+     state: restarted
+     enabled: yes
+

roles/Sharingan/tasks/main.yml

@@ -1,11 +1,12 @@
 --- 
- - name: Sharingan packages
-   become: yes
-   package:
-     name:
-       - openvas
-       - greenbone-security-assistant
-       - elasticsearch6
-       - mongodb
-       - graylog
 
+ - import_tasks: ../roles/Sharingan/tasks/siem.yml
+   when: siem is defined
+
+ - import_tasks: ../roles/Sharingan/tasks/ids.yml
+   when: secdetection is defined
+
+ - import_tasks: ../roles/Sharingan/tasks/vulns.yml
+   when: ansible_os_family == "Archlinux"
+
+ - import_tasks: ../roles/Sharingan/tasks/data.yml

roles/Sharingan/tasks/siem.yml

@@ -0,0 +1,33 @@
+---
+ - name: Sharingan packages
+   become: yes
+   register: sharingan_packages
+   package:
+     name:
+       - elasticsearch
+       - mongodb
+       - graylog
+     state: present
+
+ - name: Sharingan services
+   become: yes
+   loop:
+       - elasticsearch
+       - mongodb
+       - graylog
+   service:
+     name: "{{ item }}" 
+     state: started
+     enabled: yes
+
+ - name: Sharingan backups directory
+   become: yes
+   file:
+     path: /usr/local/backups/elasticsearch
+     state: directory
+     owner: elasticsearch
+     group: elasticsearch
+     mode: 0770
+
+ - name: Set Sharingan backups
+   command: "curl -X PUT localhost:9200/_snapshot/my_backup?pretty -H 'Content-Type: application/json' -d '{ type: fs, settings: { location: /usr/local/backup/elasticsearch, compress: true } }'"

roles/Sharingan/tasks/vulns.yml

@@ -0,0 +1,45 @@
+---
+
+ - name: Install lynis
+   register: lynis_pkg
+   become: yes
+   package:
+     name:
+       - lynis
+       - arch-audit
+       - clamav
+     state: present
+
+ - name: lynis config
+   register: lynis_conf
+   become: yes
+   copy:
+     src: lynis/custom.prf
+     dest: /etc/lynis/custom.prf
+     owner: root
+     group: root
+     mode: 0600
+
+ - name: lynis services
+   become: yes
+   copy:
+     src: "lynis/{{ item }}" 
+     dest: /usr/lib/systemd/system/
+     owner: root
+     group: root
+     mode: 0664
+   loop:
+     - sharingan-vulns.service
+     - sharingan-vulns.timer
+     - freshclam.service
+     - freshclam.timer
+
+ - name: Enable timers
+   become: yes
+   loop:
+     - freshclam.timer
+     - sharingan-vulns.timer
+   service:
+     name: "{{ item }}"
+     state: restarted
+     enabled: yes