
# WORK IN PROGRESS

# Aggregated Log Source Ingestion a.k.a. ALSI (Cribl LogStream) Notes

## Adding Cribl for a Customer

Copy the `175-splunk-alsi` directory from an existing customer (or test Moose) to the customer's directory in the `xdr-terraform-live` repository.

```shell
cp -a ~/xdr-terraform-live/prod/aws-us-gov/mdr-prod-bas/175-splunk-alsi ~/xdr-terraform-live/prod/aws-us-gov/mdr-prod-afs/
```

## Create Worker nodes

To create one or more worker nodes along with the leader, modify `xdr-terraform-modules/base/splunk_servers/alsi/config.sls` and set the number of workers as an exception, using the AWS account name.

```hcl
  # If cribl is being used for log ingestion, remember to turn on splunk_private_hec
  # in `splunk_servers/indexer_cluster/config.tf`, too.
  alsi_workers_default = 0 # how many cribl workers
  alsi_workers_exceptions = {
    afs-mdr-test-c2-gov = 2,
    mdr-prod-bas-gov    = 2,
  }
```

## Add Cribl Pillars to Customer Variables SLS

#### Enable GPG

Add `#!jinja|yaml|gpg` to the top of the customer variables SLS file if it is not present.

Copy the Cribl pillars from an existing customer such as Moose (`moose_variables.sls`) to the customer's variables file. Remove all values except the `admin_password`.

```saltstack
{% if grains['id'].startswith('bas-alsi-') %}
cribl:
  privatekey_path: "/opt/cribl/pki/privatekey.pem"
  certificate_path: "/opt/cribl/pki/cert.pem"
  license:
  hec_token:
  admin_password: |
    -----BEGIN PGP MESSAGE-----

    Value removed
    -----END PGP MESSAGE-----
  okta_client_id:
  okta_client_secret:
{% endif %} {# If alsi #}
```

> :information_source: See the GnuPG (gpg) Notes document for instructions on how to GPG-encrypt the various values.
