{%- set MANAGERIP = salt['pillar.get']('global:managerip', '') %}
{%- set SENSORONIKEY = salt['pillar.get']('global:sensoronikey', '') %}
{%- set THEHIVEKEY = salt['pillar.get']('global:hivekey', '') %}
{%- set FEATURES = salt['pillar.get']('elastic:features', False) %}
{%- set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') %}
{%- import_json "soc/files/soc/alerts.queries.json" as alerts_queries %}
{%- import_json "soc/files/soc/alerts.actions.json" as alerts_actions %}
{%- import_json "soc/files/soc/alerts.eventfields.json" as alerts_eventfields %}
{%- import_json "soc/files/soc/hunt.queries.json" as hunt_queries %}
{%- import_json "soc/files/soc/hunt.actions.json" as hunt_actions %}
{%- import_json "soc/files/soc/hunt.eventfields.json" as hunt_eventfields %}
{
  "logFilename": "/opt/sensoroni/logs/sensoroni-server.log",
  "server": {
    "bindAddress": "0.0.0.0:9822",
    "baseUrl": "/",
    "maxPacketCount": 5000,
    "htmlDir": "html",
    {%- if ISAIRGAP is sameas true %}
    "airgapEnabled": true,
    {%- else %}
    "airgapEnabled": false,
    {%- endif %}
    "modules": {
      "filedatastore": {
        "jobDir": "jobs"
      },
      "kratos": {
        "hostUrl": "http://{{ MANAGERIP }}:4434/"
      },
      "elastic": {
        "hostUrl": "http://{{ MANAGERIP }}:9200",
        {%- if salt['pillar.get']('nodestab', {}) %}
        "remoteHostUrls": [
        {%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %}
        "https://{{ SN.split('_')|first }}:9200"{{ "," if not loop.last }}
        {%- endfor %}
        ],
        {%- endif %}
        "username": "",
        "password": "",
        "verifyCert": false
      },
{% if THEHIVEKEY != '' %}
      "thehive": {
        "hostUrl": "http://{{ MANAGERIP }}:9000/thehive",
        "key": "{{ THEHIVEKEY }}",
        "verifyCert": false
      },
{% endif %}
      "statickeyauth": {
        "anonymousCidr": "172.17.0.0/24",
        "apiKey": "{{ SENSORONIKEY }}"
      }
    },
    "client": {
      {%- if ISAIRGAP is sameas true %}
      "docsUrl": "/docs/",
      {%- else %}
      "docsUrl": "https://docs.securityonion.net/en/2.3/",
      {%- endif %}
      "hunt": {
        "advanced": true,
        "groupItemsPerPage": 10,
        "groupFetchLimit": 10,
        "eventItemsPerPage": 10,
        "eventFetchLimit": 100,
        "relativeTimeValue": 24,
        "relativeTimeUnit": 30,
        "mostRecentlyUsedLimit": 5,
        "dismissEnabled": false,
        "escalateEnabled": {{ 'true' if THEHIVEKEY != '' else 'false' }},
        "eventFields": {{ hunt_eventfields | json }},
        "queryBaseFilter": "",
        "queryToggleFilters": [],
        "queries": {{ hunt_queries | json }},
        "actions": {{ hunt_actions | json }}           
      },
      "alerts": {
        "advanced": false,
        "groupItemsPerPage": 50,
        "groupFetchLimit": 500,
        "eventItemsPerPage": 50,
        "eventFetchLimit": 500,
        "relativeTimeValue": 24,
        "relativeTimeUnit": 30,
        "mostRecentlyUsedLimit": 5,
        "dismissEnabled": true,
        "escalateEnabled": {{ 'true' if THEHIVEKEY != '' else 'false' }},
        "eventFields": {{ alerts_eventfields | json }},
        "queryBaseFilter": "event.dataset:alert",
        "queryToggleFilters": [
          { "name": "acknowledged", "filter": "event.acknowledged:true", "enabled": false, "exclusive": true },
          { "name": "escalated", "filter": "event.escalated:true", "enabled": false, "exclusive": true, "enablesToggles":["acknowledged"] }
        ],
        "queries": {{ alerts_queries | json }},
        "actions": {{ alerts_actions | json }}        
      }        
    }
  }
}
