CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12904 from Security-Onion-Solutions/jertel/wf

Browse Source 
mark detections settings as read-only via the UI
This commit is contained in:
Jason Ertel
2024-05-01 09:54:03 -07:00
committed by GitHub
parent e6f45161c1 252d9a5320
commit 05c69925c9
2 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
salt/idstools/soc_idstools.yaml
View File

@@ -19,33 +19,40 @@ idstools:
helpLink: rules.html helpLink: rules.html
sids: sids:
disabled: disabled:
description: Contains the list of NIDS rules manually disabled across the grid. To disable a rule, add its Signature ID (SID) to the Current Grid Value box, one entry per line. To disable multiple rules, you can use regular expressions. description: Contains the list of NIDS rules (or regex patterns) disabled across the grid. This setting is readonly; Use the Detections screen to disable rules.
global: True global: True
multiline: True multiline: True
forcedType: "[]string" forcedType: "[]string"
regex: \d*|re:.* regex: \d*|re:.*
helpLink: managing-alerts.html helpLink: managing-alerts.html
readonlyUi: True
advanced: true
enabled: enabled:
description: Contains the list of NIDS rules manually enabled across the grid. To enable a rule, add its Signature ID (SID) to the Current Grid Value box, one entry per line. To enable multiple rules, you can use regular expressions. description: Contains the list of NIDS rules (or regex patterns) enabled across the grid. This setting is readonly; Use the Detections screen to enable rules.
global: True global: True
multiline: True multiline: True
forcedType: "[]string" forcedType: "[]string"
regex: \d*|re:.* regex: \d*|re:.*
helpLink: managing-alerts.html helpLink: managing-alerts.html
readonlyUi: True
advanced: true
modify: modify:
description: Contains the list of NIDS rules that were modified from their default values. Entries must adhere to the following format - SID "REGEX_SEARCH_TERM" "REGEX_REPLACE_TERM" description: Contains the list of NIDS rules (SID "REGEX_SEARCH_TERM" "REGEX_REPLACE_TERM"). This setting is readonly; Use the Detections screen to modify rules.
global: True global: True
multiline: True multiline: True
forcedType: "[]string" forcedType: "[]string"
helpLink: managing-alerts.html helpLink: managing-alerts.html
readonlyUi: True
advanced: true
rules: rules:
local__rules: local__rules:
description: Contains the list of custom NIDS rules applied to the grid. To add custom NIDS rules to the grid, enter one rule per line in the Current Grid Value box. description: Contains the list of custom NIDS rules applied to the grid. This setting is readonly; Use the Detections screen to adjust rules.
file: True file: True
global: True global: True
advanced: True advanced: True
title: Local Rules title: Local Rules
helpLink: local-rules.html helpLink: local-rules.html
readonlyUi: True
filters__rules: filters__rules:
description: If you are using Suricata for metadata, then you can set custom filters for that metadata here. description: If you are using Suricata for metadata, then you can set custom filters for that metadata here.
file: True file: True

4
salt/suricata/soc_suricata.yaml
View File

@@ -4,13 +4,15 @@ suricata:
helpLink: suricata.html helpLink: suricata.html
thresholding: thresholding:
sids__yaml: sids__yaml:
description: Threshold SIDS List description: Threshold SIDS List. This setting is readonly; Use the Detections screen to modify rules.
syntax: yaml syntax: yaml
file: True file: True
global: True global: True
multiline: True multiline: True
title: SIDS title: SIDS
helpLink: suricata.html helpLink: suricata.html
readonlyUi: True
advanced: true
classification: classification:
classification__config: classification__config:
description: Classifications config file. description: Classifications config file.