Security Automation with Ansible 2

Collecting log artifacts for incident response

The key phase in incident response is log analysis. The following playbook will collect the logs from all the hosts and store it locally. This allows responders to perform the further analysis:

# Reference https://www.Ansible.com/security-automation-with-Ansible- name: Gather log files  hosts: servers  become: yes  tasks:    - name: List files to grab      find:        paths:          - /var/log        patterns:          - '*.log*'        recurse: yes      register: log_files    - name: Grab files      fetch:        src: "{{ item.path }}"        dest: "/tmp/LOGS_{{ Ansible_fqdn }}/"      with_items: "{{ log_files.files }}"

The following playbook execution will collect a list of logs in specified locations in remote hosts using Ansible modules and store them in the local system. ...