CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-16 05:53:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

map pcap dir to container. enable pcap-log in map

Browse Source
This commit is contained in:
m0duspwnens
2024-01-30 13:39:35 -05:00
parent 37dcb84a09
commit 0522dc180a
3 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
salt/suricata/enabled.sls
View File

@@ -35,6 +35,9 @@ so-suricata:
- /nsm/suricata/:/nsm/:rw - /nsm/suricata/:/nsm/:rw
- /nsm/suricata/extracted:/var/log/suricata//filestore:rw - /nsm/suricata/extracted:/var/log/suricata//filestore:rw
- /opt/so/conf/suricata/bpf:/etc/suricata/bpf:ro - /opt/so/conf/suricata/bpf:/etc/suricata/bpf:ro
{% if GLOBALS.pcap_engine == "SURICATA" %}
- /nsm/suripcap/:/nsm/pcap:rw
{% endif %}
{% if DOCKER.containers['so-suricata'].custom_bind_mounts %} {% if DOCKER.containers['so-suricata'].custom_bind_mounts %}
{% for BIND in DOCKER.containers['so-suricata'].custom_bind_mounts %} {% for BIND in DOCKER.containers['so-suricata'].custom_bind_mounts %}
- {{ BIND }} - {{ BIND }}

5
salt/suricata/map.jinja
View File

@@ -60,6 +60,11 @@
{% do SURICATAMERGED.config.outputs['file-store'].update({'enabled':suricata_mdengine.suricata.config.outputs[surimeta_filestore_index]['file-store']['enabled']}) %} {% do SURICATAMERGED.config.outputs['file-store'].update({'enabled':suricata_mdengine.suricata.config.outputs[surimeta_filestore_index]['file-store']['enabled']}) %}
{% endif %} {% endif %}
{# before we change outputs back to list, enable pcap-log if suricata is the pcapengine #}
{% if GLOBALS.pcap_engine == "SURICATA" %}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'enabled': 'yes'}) %}
{% endif %}
{# outputs is a list but we convert to dict in defaults to work with ui #} {# outputs is a list but we convert to dict in defaults to work with ui #}
{# below they are converted back to lists #} {# below they are converted back to lists #}
{% load_yaml as outputs %} {% load_yaml as outputs %}

4
salt/suricata/pcap.sls
View File

@@ -9,8 +9,8 @@ suripcapdir:
- mode: 755 - mode: 755
- makedirs: True - makedirs: True
{# there should only be 1 interface in af-packet so we can just reference the first list item #}
{% for i in range(1, SURICATAMERGED.config['af-packet'].threads) + 1) %} {% for i in range(1, SURICATAMERGED.config['af-packet'][0].threads + 1) %}
suripcapthread{{i}}dir: suripcapthread{{i}}dir:
file.directory: file.directory: