awatch-rus/AWatch-rus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(dfir): add hayabusa forensic workflow integration

Browse Source
This commit is contained in:
igor04091968
2026-05-14 15:04:07 +03:00
parent 563bd910d1
commit 0cce6fd08e
28 changed files with 1907 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/deploy_aw_server.yml
+93
View File
@@ -1314,6 +1314,99 @@
msg: "{{ aw_hayabusa_ioc_refresh_result.stdout }}"
when: aw_hayabusa_ioc_refresh_result.stdout is defined
- name: Установить server-side Hayabusa runner
when: aw_hayabusa_runner_enabled | default(false) | bool
block:
- name: Создать каталоги Hayabusa
ansible.builtin.file:
path: "{{ item }}"
state: directory
owner: root
group: root
mode: "0755"
loop:
- "{{ aw_hayabusa_root }}"
- "{{ aw_hayabusa_root }}/releases"
- "{{ aw_hayabusa_release_dir }}"
- "{{ aw_hayabusa_reports_dir }}"
- "{{ aw_hayabusa_state_dir }}"
- "{{ aw_hayabusa_inbox_dir }}"
- "{{ aw_hayabusa_archive_dir }}"
- "{{ aw_hayabusa_incoming_dir }}"
- "{{ aw_hayabusa_staging_dir }}"
- "{{ aw_hayabusa_archive_packages_dir }}"
- "{{ aw_hayabusa_archive_extracted_dir }}"
- "{{ aw_hayabusa_logs_dir }}"
- name: Скачать архив Hayabusa
ansible.builtin.get_url:
url: "{{ aw_hayabusa_download_url }}"
dest: "{{ aw_hayabusa_archive_path }}"
mode: "0644"
- name: Распаковать pinned Hayabusa release
ansible.builtin.unarchive:
src: "{{ aw_hayabusa_archive_path }}"
dest: "{{ aw_hayabusa_release_dir }}"
remote_src: true
creates: "{{ aw_hayabusa_release_dir }}/{{ aw_hayabusa_binary_name }}"
- name: Нормализовать права release Hayabusa
ansible.builtin.file:
path: "{{ aw_hayabusa_release_dir }}"
state: directory
owner: root
group: root
mode: "0755"
recurse: true
- name: Сделать бинарь Hayabusa исполняемым
ansible.builtin.file:
path: "{{ aw_hayabusa_release_dir }}/{{ aw_hayabusa_binary_name }}"
owner: root
group: root
mode: "0755"
state: file
- name: Создать canonical symlink на текущий релиз Hayabusa
ansible.builtin.file:
src: "{{ aw_hayabusa_release_dir }}"
dest: "{{ aw_hayabusa_current_link }}"
state: link
force: true
- name: Создать canonical symlink на бинарь Hayabusa
ansible.builtin.file:
src: "{{ aw_hayabusa_binary_name }}"
dest: "{{ aw_hayabusa_release_dir }}/hayabusa"
state: link
force: true
- name: Установить wrapper aw-hayabusa
ansible.builtin.copy:
src: "{{ aw_repo_root }}/aw-server/hayabusa/aw-hayabusa.sh"
dest: /usr/local/bin/aw-hayabusa
owner: root
group: root
mode: "0755"
- name: Проверить server-side runner через doctor
ansible.builtin.command:
cmd: /usr/local/bin/aw-hayabusa doctor
changed_when: false
- name: Проверить загрузку profiles Hayabusa
ansible.builtin.shell: /usr/local/bin/aw-hayabusa profiles > /tmp/aw-hayabusa-profiles.txt
args:
executable: /bin/bash
changed_when: false
- name: Проверить наличие standard profile у Hayabusa
ansible.builtin.shell: "grep -q 'standard:' /tmp/aw-hayabusa-profiles.txt"
args:
executable: /bin/bash
changed_when: false
- name: Post-deploy health gate (aw-health-check)
when:
- not ansible_check_mode
ansible/deploy_aw_windows.yml
+10
View File
@@ -38,6 +38,7 @@
aw_windows_incident_capture_enabled: true
aw_windows_incident_screenshot_enabled: true
aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
aw_windows_forensics_root: "{{ aw_windows_state_root }}\\forensics\\evtx-exports"
aw_windows_logon_marker_enabled: true
aw_windows_skip_hardening: false
aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
@@ -169,6 +170,8 @@
IncidentCaptureEnabled = {{ '$true' if (aw_windows_incident_capture_enabled | bool) else '$false' }}
IncidentScreenshotEnabled = {{ '$true' if (aw_windows_incident_screenshot_enabled | bool) else '$false' }}
IncidentArtifactsRoot = "{{ aw_windows_incident_artifacts_root }}"
EvtxExportRoot = "{{ aw_windows_forensics_root }}"
EvtxRetentionDays = {{ aw_windows_evtx_retention_days | int }}
LogonMarkerEnabled = {{ '$true' if (aw_windows_logon_marker_enabled | bool) else '$false' }}
PolicyMode = "{{ aw_windows_policy_mode }}"
PolicyEngineEnabled = {{ '$true' if (aw_windows_policy_engine_enabled | bool) else '$false' }}
@@ -185,6 +188,13 @@
{% if (aw_windows_package_zip_path | default('') | string | length) > 0 %}
$params.PackageZipPath = "{{ aw_windows_package_zip_path }}"
{% endif %}
{% if (aw_windows_evtx_channels | default([]) | length) > 0 %}
$params.EvtxChannels = @(
{% for channel in aw_windows_evtx_channels %}
"{{ channel }}"{% if not loop.last %},{% endif %}
{% endfor %}
)
{% endif %}
{% if (aw_windows_hostname_override | default('') | string | length) > 0 %}
$params.AwHostname = "{{ aw_windows_hostname_override }}"
{% endif %}
ansible/deploy_tsj_guardian_bot_proxmox.yml
+54 -6
View File
@@ -18,14 +18,24 @@
tsj_bot_default_chat_id: "{{ telegram_default_chat_id | default(telegram_allowed_chat_ids.split(',')[0]) }}"
pre_tasks:
- name: Проверить наличие существующего .env бота на хосте
ansible.builtin.stat:
path: "{{ tsj_bot_env_path }}"
register: tsj_bot_existing_env
- name: Проверить обязательные переменные
ansible.builtin.assert:
that:
- telegram_bot_token is defined
- telegram_bot_token | length > 20
- telegram_allowed_chat_ids is defined
- telegram_allowed_chat_ids | length > 0
fail_msg: "Задайте telegram_bot_token и telegram_allowed_chat_ids (см. group_vars/proxmox-bot.example.yml)."
- >
(
telegram_bot_token is defined and
(telegram_bot_token | string | length) > 20 and
telegram_allowed_chat_ids is defined and
(telegram_allowed_chat_ids | string | length) > 0
)
or
(tsj_bot_existing_env.stat.exists | default(false))
fail_msg: "Задайте telegram_bot_token и telegram_allowed_chat_ids или оставьте на хосте существующий {{ tsj_bot_env_path }}."
- name: Проверить наличие исходного файла бота на контроллере
ansible.builtin.stat:
@@ -70,7 +80,12 @@
mode: "0750"
notify: Restart tsj bot
- name: Сгенерировать .env бота
- name: Сгенерировать полный .env бота
when:
- telegram_bot_token is defined
- (telegram_bot_token | string | length) > 20
- telegram_allowed_chat_ids is defined
- (telegram_allowed_chat_ids | string | length) > 0
ansible.builtin.copy:
dest: "{{ tsj_bot_env_path }}"
owner: "{{ tsj_bot_user }}"
@@ -133,11 +148,44 @@
AW_RUS_WORKTIME_BASE={{ tsj_bot_aw_rus_worktime_base | default('http://10.10.10.13:5610') }}
AW_RUS_WORKTIME_HEAL_CMD={{ tsj_bot_aw_rus_worktime_heal_cmd | default("sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S /usr/local/bin/aw-worktime-autoheal.sh && sudo -S systemctl start aw-worktime-ui-bridge.service'") }}
AW_RUS_DLP_HEAL_CMD={{ tsj_bot_aw_rus_dlp_heal_cmd | default("sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S systemctl restart activitywatch-server.service && sudo -S systemctl start activitywatch-dlp-aggregator.service || true && sudo -S /usr/local/bin/aw-health-check && sudo -S /usr/local/bin/dlp-health-check'") }}
AW_RUS_CASE_API_BASE={{ tsj_bot_aw_rus_case_api_base | default('http://10.10.10.13:5602') }}
AW_RUS_HAYABUSA_ENABLED={{ tsj_bot_aw_rus_hayabusa_enabled | default('true') }}
AW_RUS_HAYABUSA_SSH_CMD={{ tsj_bot_aw_rus_hayabusa_ssh_cmd | default("sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13") }}
AW_RUS_HOST={{ tsj_bot_aw_rus_host | default('SHARKON2025') }}
AW_RUS_PRIMARY_USER={{ tsj_bot_aw_rus_primary_user | default('USER1') }}
AW_RUS_STALE_SEC={{ tsj_bot_aw_rus_stale_sec | default(900) }}
notify: Restart tsj bot
- name: Обновить только AW-Rus/Hayabusa env ключи в существующем .env
when:
- not (
telegram_bot_token is defined and
(telegram_bot_token | string | length) > 20 and
telegram_allowed_chat_ids is defined and
(telegram_allowed_chat_ids | string | length) > 0
)
- tsj_bot_existing_env.stat.exists | default(false)
ansible.builtin.lineinfile:
path: "{{ tsj_bot_env_path }}"
regexp: "^{{ item.key }}="
line: "{{ item.key }}={{ item.value }}"
create: false
owner: "{{ tsj_bot_user }}"
group: "{{ tsj_bot_group }}"
mode: "0640"
loop:
- { key: "AW_RUS_API_BASE", value: "{{ tsj_bot_aw_rus_api_base | default('http://10.10.10.13:5600/api/0') }}" }
- { key: "AW_RUS_WORKTIME_BASE", value: "{{ tsj_bot_aw_rus_worktime_base | default('http://10.10.10.13:5610') }}" }
- { key: "AW_RUS_WORKTIME_HEAL_CMD", value: "{{ tsj_bot_aw_rus_worktime_heal_cmd | default(\"sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S /usr/local/bin/aw-worktime-autoheal.sh && sudo -S systemctl start aw-worktime-ui-bridge.service'\") }}" }
- { key: "AW_RUS_DLP_HEAL_CMD", value: "{{ tsj_bot_aw_rus_dlp_heal_cmd | default(\"sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S systemctl restart activitywatch-server.service && sudo -S systemctl start activitywatch-dlp-aggregator.service || true && sudo -S /usr/local/bin/aw-health-check && sudo -S /usr/local/bin/dlp-health-check'\") }}" }
- { key: "AW_RUS_CASE_API_BASE", value: "{{ tsj_bot_aw_rus_case_api_base | default('http://10.10.10.13:5602') }}" }
- { key: "AW_RUS_HAYABUSA_ENABLED", value: "{{ tsj_bot_aw_rus_hayabusa_enabled | default('true') }}" }
- { key: "AW_RUS_HAYABUSA_SSH_CMD", value: "{{ tsj_bot_aw_rus_hayabusa_ssh_cmd | default(\"sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13\") }}" }
- { key: "AW_RUS_HOST", value: "{{ tsj_bot_aw_rus_host | default('SHARKON2025') }}" }
- { key: "AW_RUS_PRIMARY_USER", value: "{{ tsj_bot_aw_rus_primary_user | default('USER1') }}" }
- { key: "AW_RUS_STALE_SEC", value: "{{ tsj_bot_aw_rus_stale_sec | default(900) }}" }
notify: Restart tsj bot
- name: Установить systemd unit бота
ansible.builtin.copy:
dest: "/etc/systemd/system/{{ tsj_bot_service_name }}"
ansible/group_vars/aw_server.yml
+18
View File
@@ -12,6 +12,24 @@ ansible_become_password: "{{ lookup('env', 'AW_SUDO_PASSWORD') | default(lookup(
aw_hayabusa_ioc_refresh_enabled: false
aw_hayabusa_rules_root: "/mnt/usb_hdd1/Projects/hayabusa/rules"
aw_hayabusa_ioc_output_dir: "{{ aw_server_data_dir }}/dlp-ioc"
aw_hayabusa_runner_enabled: true
aw_hayabusa_version: "v3.9.0"
aw_hayabusa_asset_name: "hayabusa-3.9.0-lin-x64-gnu.zip"
aw_hayabusa_binary_name: "hayabusa-3.9.0-lin-x64-gnu"
aw_hayabusa_download_url: "https://github.com/Yamato-Security/hayabusa/releases/download/v3.9.0/hayabusa-3.9.0-lin-x64-gnu.zip"
aw_hayabusa_root: "/opt/hayabusa"
aw_hayabusa_release_dir: "{{ aw_hayabusa_root }}/releases/{{ aw_hayabusa_version }}"
aw_hayabusa_current_link: "{{ aw_hayabusa_root }}/current"
aw_hayabusa_archive_path: "/tmp/{{ aw_hayabusa_asset_name }}"
aw_hayabusa_reports_dir: "{{ aw_hayabusa_root }}/reports"
aw_hayabusa_state_dir: "{{ aw_hayabusa_root }}/state"
aw_hayabusa_inbox_dir: "{{ aw_hayabusa_root }}/inbox"
aw_hayabusa_archive_dir: "{{ aw_hayabusa_root }}/archive"
aw_hayabusa_incoming_dir: "{{ aw_hayabusa_inbox_dir }}/incoming"
aw_hayabusa_staging_dir: "{{ aw_hayabusa_inbox_dir }}/staging"
aw_hayabusa_archive_packages_dir: "{{ aw_hayabusa_archive_dir }}/packages"
aw_hayabusa_archive_extracted_dir: "{{ aw_hayabusa_archive_dir }}/extracted"
aw_hayabusa_logs_dir: "{{ aw_hayabusa_state_dir }}/logs"
aw_dlp_policy_engine_enabled: true
aw_dlp_policy_engine_bind_host: "0.0.0.0"
aw_dlp_policy_engine_port: 5601
ansible/group_vars/aw_windows.yml
+9
View File
@@ -41,6 +41,15 @@ aw_windows_local_agent_logs_enabled: false
aw_windows_incident_capture_enabled: true
aw_windows_incident_screenshot_enabled: true
aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
aw_windows_forensics_root: "{{ aw_windows_state_root }}\\forensics\\evtx-exports"
aw_windows_evtx_retention_days: 14
aw_windows_evtx_channels:
- Security
- System
- Application
- Microsoft-Windows-PowerShell/Operational
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
- Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
aw_windows_logon_marker_enabled: true
aw_windows_skip_hardening: false
ansible/group_vars/proxmox-bot.example.yml
+3
View File
@@ -42,6 +42,9 @@ tsj_bot_aw_rus_api_base: "http://10.10.10.13:5600/api/0"
tsj_bot_aw_rus_worktime_base: "http://10.10.10.13:5610"
tsj_bot_aw_rus_worktime_heal_cmd: "sshpass -p 'CHANGE_ME' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S /usr/local/bin/aw-worktime-autoheal.sh && sudo -S systemctl start aw-worktime-ui-bridge.service'"
tsj_bot_aw_rus_dlp_heal_cmd: "sshpass -p 'CHANGE_ME' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S systemctl restart activitywatch-server.service && sudo -S systemctl start activitywatch-dlp-aggregator.service || true && sudo -S /usr/local/bin/aw-health-check && sudo -S /usr/local/bin/dlp-health-check'"
tsj_bot_aw_rus_case_api_base: "http://10.10.10.13:5602"
tsj_bot_aw_rus_hayabusa_enabled: "true"
tsj_bot_aw_rus_hayabusa_ssh_cmd: "sshpass -p 'CHANGE_ME' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13"
tsj_bot_aw_rus_host: "SHARKON2025"
tsj_bot_aw_rus_primary_user: "USER1"
tsj_bot_aw_rus_stale_sec: 900
ansible/group_vars/windows.example.yml
+9
View File
@@ -29,6 +29,15 @@ aw_windows_local_agent_logs_enabled: false
aw_windows_incident_capture_enabled: true
aw_windows_incident_screenshot_enabled: true
aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
aw_windows_forensics_root: "{{ aw_windows_state_root }}\\forensics\\evtx-exports"
aw_windows_evtx_retention_days: 14
aw_windows_evtx_channels:
- Security
- System
- Application
- Microsoft-Windows-PowerShell/Operational
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
- Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
aw_windows_logon_marker_enabled: true
aw_windows_skip_hardening: false