151 lines
3.8 KiB
YAML
151 lines
3.8 KiB
YAML
- name: Deploy Security Monitoring Infrastructure
|
|
hosts: security_servers
|
|
become: true
|
|
vars:
|
|
prometheus_version: "2.47.0"
|
|
grafana_version: "10.1.0"
|
|
node_exporter_version: "1.6.1"
|
|
alertmanager_version: "0.25.0"
|
|
monitoring_retention_days: 30
|
|
|
|
roles:
|
|
- promotheus
|
|
- vault
|
|
- wazuh
|
|
|
|
tasks:
|
|
- name: Install Node Exporter
|
|
block:
|
|
- name: Download Node Exporter
|
|
get_url:
|
|
url: "https://github.com/prometheus/node_exporter/releases/download/v{{ node_exporter_version }}/node_exporter-{{ node_exporter_version }}.linux-amd64.tar.gz"
|
|
dest: /tmp/node_exporter.tar.gz
|
|
|
|
- name: Extract Node Exporter
|
|
unarchive:
|
|
src: /tmp/node_exporter.tar.gz
|
|
dest: /opt/
|
|
remote_src: yes
|
|
owner: prometheus
|
|
group: prometheus
|
|
|
|
- name: Create Node Exporter symlink
|
|
file:
|
|
src: "/opt/node_exporter-{{ node_exporter_version }}.linux-amd64/node_exporter"
|
|
dest: /usr/local/bin/node_exporter
|
|
state: link
|
|
|
|
- name: Create Node Exporter systemd service
|
|
copy:
|
|
content: |
|
|
[Unit]
|
|
Description=Node Exporter
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
User=prometheus
|
|
Group=prometheus
|
|
Type=simple
|
|
ExecStart=/usr/local/bin/node_exporter
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
dest: /etc/systemd/system/node_exporter.service
|
|
notify:
|
|
- reload systemd
|
|
- restart node_exporter
|
|
|
|
- name: Install Grafana
|
|
block:
|
|
- name: Add Grafana GPG key
|
|
apt_key:
|
|
url: https://packages.grafana.com/gpg.key
|
|
state: present
|
|
|
|
- name: Add Grafana repository
|
|
apt_repository:
|
|
repo: "deb https://packages.grafana.com/oss/deb stable main"
|
|
state: present
|
|
|
|
- name: Install Grafana
|
|
apt:
|
|
name: grafana
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Start and enable Grafana
|
|
service:
|
|
name: grafana-server
|
|
state: started
|
|
enabled: yes
|
|
|
|
- name: Configure security monitoring alerts
|
|
copy:
|
|
content: |
|
|
groups:
|
|
- name: security_alerts
|
|
rules:
|
|
- alert: WazuhManagerDown
|
|
expr: up{job="wazuh"} == 0
|
|
for: 2m
|
|
labels:
|
|
severity: critical
|
|
annotations:
|
|
summary: "Wazuh Manager is down"
|
|
|
|
- alert: VaultSealed
|
|
expr: vault_core_unsealed == 0
|
|
for: 1m
|
|
labels:
|
|
severity: critical
|
|
annotations:
|
|
summary: "Vault is sealed"
|
|
|
|
- alert: HighCPUUsage
|
|
expr: 100 - (avg by(instance) (irate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
|
|
for: 5m
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: "High CPU usage on {{ $labels.instance }}"
|
|
dest: /etc/prometheus/security_rules.yml
|
|
owner: prometheus
|
|
group: prometheus
|
|
notify: restart prometheus
|
|
|
|
handlers:
|
|
- name: reload systemd
|
|
systemd:
|
|
daemon_reload: yes
|
|
|
|
- name: restart prometheus
|
|
service:
|
|
name: prometheus
|
|
state: restarted
|
|
|
|
- name: restart node_exporter
|
|
service:
|
|
name: node_exporter
|
|
state: restarted
|
|
enabled: yes
|
|
|
|
post_tasks:
|
|
- name: Verify monitoring services
|
|
service:
|
|
name: "{{ item }}"
|
|
state: started
|
|
enabled: yes
|
|
loop:
|
|
- prometheus
|
|
- node_exporter
|
|
- grafana-server
|
|
|
|
- name: Display monitoring URLs
|
|
debug:
|
|
msg: |
|
|
Monitoring services available at:
|
|
- Prometheus: http://{{ ansible_default_ipv4.address }}:9090
|
|
- Grafana: http://{{ ansible_default_ipv4.address }}:3000
|
|
- Node Exporter: http://{{ ansible_default_ipv4.address }}:9100
|