Tagging/beats security

roles/beats/tasks/auditbeat.yml

@@ -10,6 +10,9 @@
       string ) if (elasticstack_version is defined and elasticstack_version | length > 0)) |
       replace(' ', '')
       }}
+  tags:
+    - auditbeat
+    - name
 
 - name: Install Auditbeat - rpm - full stack
   ansible.builtin.package:
@@ -21,6 +24,9 @@
   when:
     - ansible_os_family == "RedHat"
     - elasticstack_full_stack | bool
+  tags:
+    - auditbeat
+    - rpm
 
 - name: Install Auditbeat - rpm - standalone
   ansible.builtin.package:
@@ -30,6 +36,10 @@
   when:
     - ansible_os_family == "RedHat"
     - not elasticstack_full_stack | bool
+  tags:
+    - auditbeat
+    - standalone
+    - rpm
 
 - name: Install Auditbeat - deb
   ansible.builtin.package:
@@ -38,6 +48,9 @@
     - Restart Auditbeat
   when:
     - ansible_os_family == "Debian"
+  tags:
+    - auditbeat
+    - deb
 
 # KICS complains about "latest" package but this is a dedicated update task
 
@@ -55,11 +68,15 @@
     - elasticstack_version == "latest"
     - ansible_os_family == "RedHat"
     - elasticstack_full_stack | bool
+  tags:
+    - auditbeat
+    - fullstack
+    - rpm
 
 - name: Install Auditbeat latest version - rpm - standalone
   ansible.builtin.package:
     name: auditbeat
     state: latest
   notify:
     - Restart Auditbeat
   when:
@@ -67,17 +84,25 @@
     - elasticstack_version == "latest"
     - ansible_os_family == "RedHat"
     - not elasticstack_full_stack | bool
+  tags:
+    - auditbeat
+    - latest
+    - rpm
 
 - name: Install Auditbeat latest version - deb
   ansible.builtin.package:
     name: auditbeat
     state: latest
   notify:
     - Restart Auditbeat
   when:
     - elasticstack_version is defined
     - elasticstack_version == "latest"
     - ansible_os_family == "Debian"
+  tags:
+    - auditbeat
+    - latest
+    - deb
 
 - name: Configure Auditbeat
   ansible.builtin.template:
@@ -105,10 +130,16 @@
   when:
     - beats_auditbeat_setup | bool
     - beats_auditbeat_output == "elasticsearch"
+  tags:
+    - auditbeat
+    - setup
 
 - name: Start Auditbeat
   ansible.builtin.service:
     name: auditbeat
     state: started
     enabled: true
   when: beats_auditbeat_enable | bool
+  tags:
+    - auditbeat
+    - start

roles/beats/tasks/beats-security.yml

@@ -3,6 +3,9 @@
   ansible.builtin.stat:
     path: "/etc/beats/certs/{{ inventory_hostname }}-beats.crt"
   register: beats_cert_exists
+  tags:
+    - beat_security
+    - cert_check
 
 - name: Get the beats certificate expiration date
   community.crypto.x509_certificate_info:
@@ -11,18 +14,27 @@
       check_period: "{{ beats_cert_expiration_buffer }}"
   register: beats_cert_expiration_date
   when: beats_cert_exists.stat.exists | bool
+  tags:
+    - beat_security
+    - cert_expiration_date
 
 - name: Set beats certificate will expire soon to true
   ansible.builtin.set_fact:
     beats_cert_will_expire_soon: true
   when: beats_cert_expiration_date.skipped is not defined and not beats_cert_expiration_date.valid_at.check_period
+  tags:
+    - beat_security
+    - cert_expiration_soon
 
 - name: Print the beats certificate renew message
   ansible.builtin.debug:
     msg: |
       Your beats certificate will expire before {{ beats_cert_expiration_buffer }}.
       Ansible will renew it.
   when: beats_cert_expiration_date.skipped is not defined and not beats_cert_expiration_date.valid_at.check_period
+  tags:
+    - beat_security
+    - cert_renewal_message
 
 - name: Backup beats certs then remove
   when: "'renew_beats_cert' in ansible_run_tags or 'renew_ca' in ansible_run_tags or beats_cert_will_expire_soon | bool"

roles/beats/tasks/filebeat.yml

@@ -9,6 +9,9 @@
       elasticstack_version |
       string ) if (elasticstack_version is defined and elasticstack_version | length > 0)) |
       replace(' ', '') }}
+  tags:
+    - filebeat
+    - name
 
 - name: Install Filebeat - rpm - full stack
   ansible.builtin.package:
@@ -20,6 +23,9 @@
   when:
     - ansible_os_family == "RedHat"
     - elasticstack_full_stack | bool
+  tags:
+    - filebeat
+    - rpm
 
 - name: Install Filebeat - rpm - standalone
   ansible.builtin.package:
@@ -29,6 +35,10 @@
   when:
     - ansible_os_family == "RedHat"
     - not elasticstack_full_stack | bool
+  tags:
+    - filebeat
+    - standalone
+    - rpm
 
 - name: Install Filebeat - deb
   ansible.builtin.package:
@@ -37,11 +47,14 @@
     - Restart Filebeat
   when:
     - ansible_os_family == "Debian"
+  tags:
+    - filebeat
+    - deb
 
 - name: Install Filebeat latest version - rpm - full stack
   ansible.builtin.package:
     name: filebeat
     state: latest
     enablerepo:
       - "elastic-{{ elasticstack_release }}.x"
   notify:
@@ -51,11 +64,15 @@
     - elasticstack_version == "latest"
     - ansible_os_family == "RedHat"
     - elasticstack_full_stack | bool
+  tags:
+    - filebeat
+    - fullstack
+    - rpm
 
 - name: Install Filebeat latest version - rpm - standalone
   ansible.builtin.package:
     name: filebeat
     state: latest
   notify:
     - Restart Filebeat
   when:
@@ -63,17 +80,25 @@
     - elasticstack_version == "latest"
     - ansible_os_family == "RedHat"
     - not elasticstack_full_stack | bool
+  tags:
+    - filebeat
+    - latest
+    - rpm
 
 - name: Install Filebeat latest version - deb
   ansible.builtin.package:
     name: filebeat
     state: latest
   notify:
     - Restart Filebeat
   when:
     - elasticstack_version is defined
     - elasticstack_version == "latest"
     - ansible_os_family == "Debian"
+  tags:
+    - filebeat
+    - latest
+    - deb
 
 - name: Configure Filebeat
   ansible.builtin.template:
@@ -122,10 +147,16 @@
       with_items: "{{ beats_filebeat_modules }}"
       notify:
         - Restart Filebeat
+      tags:
+        - filebeat
+        - setup
 
 - name: Start Filebeat
   ansible.builtin.service:
     name: filebeat
     state: started
     enabled: true
   when: beats_filebeat_enable | bool
+  tags:
+    - filebeat
+    - start

roles/beats/tasks/metricbeat.yml

@@ -10,6 +10,9 @@
       string ) if (elasticstack_version is defined and elasticstack_version | length > 0)) |
       replace(' ', '')
       }}
+  tags:
+    - metricbeat
+    - name
 
 - name: Install Metricbeat - rpm - full stack
   ansible.builtin.package:
@@ -21,6 +24,10 @@
   when:
     - ansible_os_family == "RedHat"
     - elasticstack_full_stack | bool
+  tags:
+    - metricbeat
+    - fullstack
+    - rpm
 
 - name: Install Metricbeat - rpm - standalone
   ansible.builtin.package:
@@ -30,6 +37,10 @@
   when:
     - ansible_os_family == "RedHat"
     - not elasticstack_full_stack | bool
+  tags:
+    - metricbeat
+    - standalone
+    - rpm
 
 - name: Install Metricbeat - deb
   ansible.builtin.package:
@@ -38,11 +49,14 @@
     - Restart Metricbeat
   when:
     - ansible_os_family == "Debian"
+  tags:
+    - metricbeat
+    - deb
 
 - name: Install Metricbeat latest version - rpm - full stack
   ansible.builtin.package:
     name: metricbeat
     state: latest
     enablerepo:
       - "elastic-{{ elasticstack_release }}.x"
   notify:
@@ -52,11 +66,15 @@
     - elasticstack_version == "latest"
     - ansible_os_family == "RedHat"
     - elasticstack_full_stack | bool
+  tags:
+    - metricbeat
+    - fullstack
+    - rpm
 
 - name: Install Metricbeat latest version - rpm - standalone
   ansible.builtin.package:
     name: metricbeat
     state: latest
   notify:
     - Restart Metricbeat
   when:
@@ -64,18 +82,25 @@
     - elasticstack_version == "latest"
     - ansible_os_family == "RedHat"
     - not elasticstack_full_stack | bool
-
+  tags:
+    - metricbeat
+    - latest
+    - rpm
 
 - name: Install Metricbeat latest version - deb
   ansible.builtin.package:
     name: metricbeat
     state: latest
   notify:
     - Restart Metricbeat
   when:
     - elasticstack_version is defined
     - elasticstack_version == "latest"
     - ansible_os_family == "Debian"
+  tags:
+    - metricbeat
+    - latest
+    - deb
 
 - name: Configure Metricbeat
   ansible.builtin.template:
@@ -86,13 +111,20 @@
     mode: 0644
   notify:
     - Restart Metricbeat
+  tags:
+    - configuration
+    - beats_metricbeat_configuration
+    - beats_configuration
 
 - name: Enable modules
   ansible.builtin.command: "metricbeat modules enable {{ item }}"
   args:
     creates: "/etc/metricbeat/modules.d/{{ item }}.yml"
   with_items: "{{ beats_metricbeat_modules }}"
   when: beats_metricbeat_modules is defined
+  tags:
+    - metricbeat
+    - metricbeat_enable_module
 
 - name: Enable Ingest Pipelines
   ansible.builtin.command: >
@@ -106,10 +138,16 @@
   when:
     - beats_metricbeat_modules is defined
     - beats_metricbeat_output == "elasticsearch"
+  tags:
+    - metricbeat
+    - metricbeat_ingest_pipelines
 
 - name: Start Metricbeat
   ansible.builtin.service:
     name: metricbeat
     state: started
     enabled: true
   when: beats_metricbeat_enable | bool
+  tags:
+    - metricbeat
+    - metricbeat_start

roles/elasticstack/defaults/main.yml

@@ -26,6 +26,7 @@ elasticstack_security: true
 elasticstack_variant: elastic
 elasticstack_force_pip: false
 elasticstack_manage_pip: false
+elasticstack_encryption_key_size: 64
 
   # for debugging only
 elasticstack_no_log: true

roles/kibana/defaults/main.yml

@@ -14,6 +14,7 @@ kibana_cert_validity_period: 1095
 kibana_cert_will_expire_soon: false
 kibana_sniff_on_start: false
 kibana_sniff_on_connection_fault: false
+kibana_custom_default_index: 979390d0-3def-11ea-ad1f-5b09c073c7d3
 
 kibana_freshstart:
   changed: false

roles/kibana/tasks/kibana-default-index.yml

@@ -0,0 +1,16 @@
+---
+
+- name: Set Custom Default Index
+  ansible.builtin.uri:
+    url: 'http://{{ ansible_default_ipv4.address }}:5601/api/kibana/settings'
+    method: POST
+    body:
+      changes:
+        defaultIndex: '{{ kibana_custom_default_index }}'
+    body_format: json
+    headers:
+      kbn-version: 8.19.11
+      Content-Type: application/json
+  register: result
+- ansible.builtin.debug:
+    msg: "setting new custom Index to {{ kibana_custom_default_index }}"