CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix pcap paths

Browse Source
This commit is contained in:
Mike Reeves
2024-01-31 08:58:57 -05:00
parent 4be1214bab
commit 00289c201e
3 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
salt/sensoroni/enabled.sls
View File

@@ -23,6 +23,9 @@ so-sensoroni:
- /opt/so/conf/sensoroni/sensoroni.json:/opt/sensoroni/sensoroni.json:ro - /opt/so/conf/sensoroni/sensoroni.json:/opt/sensoroni/sensoroni.json:ro
- /opt/so/conf/sensoroni/analyzers:/opt/sensoroni/analyzers:rw - /opt/so/conf/sensoroni/analyzers:/opt/sensoroni/analyzers:rw
- /opt/so/log/sensoroni:/opt/sensoroni/logs:rw - /opt/so/log/sensoroni:/opt/sensoroni/logs:rw
{% if GLOBALS.pcap_engine == "SURICATA" %}
- /nsm/suripcap/:/nsm/suripcap:rw
{% endif %}
{% if DOCKER.containers['so-sensoroni'].custom_bind_mounts %} {% if DOCKER.containers['so-sensoroni'].custom_bind_mounts %}
{% for BIND in DOCKER.containers['so-sensoroni'].custom_bind_mounts %} {% for BIND in DOCKER.containers['so-sensoroni'].custom_bind_mounts %}
- {{ BIND }} - {{ BIND }}

2
salt/suricata/defaults.yaml
View File

@@ -137,7 +137,7 @@ suricata:
max-files: 10 max-files: 10
use-stream-depth: "no" use-stream-depth: "no"
conditional: "all" conditional: "all"
dir: "/nsm/pcap" dir: "/nsm/suripcap"
alert-debug: alert-debug:
enabled: "no" enabled: "no"
alert-prelude: alert-prelude:

2
salt/suricata/enabled.sls
View File

@@ -36,7 +36,7 @@ so-suricata:
- /nsm/suricata/extracted:/var/log/suricata//filestore:rw - /nsm/suricata/extracted:/var/log/suricata//filestore:rw
- /opt/so/conf/suricata/bpf:/etc/suricata/bpf:ro - /opt/so/conf/suricata/bpf:/etc/suricata/bpf:ro
{% if GLOBALS.pcap_engine == "SURICATA" %} {% if GLOBALS.pcap_engine == "SURICATA" %}
- /nsm/suripcap/:/nsm/pcap:rw - /nsm/suripcap/:/nsm/suripcap:rw
{% endif %} {% endif %}
{% if DOCKER.containers['so-suricata'].custom_bind_mounts %} {% if DOCKER.containers['so-suricata'].custom_bind_mounts %}
{% for BIND in DOCKER.containers['so-suricata'].custom_bind_mounts %} {% for BIND in DOCKER.containers['so-suricata'].custom_bind_mounts %}