From 09b3a4a0ddeef798c93b720ea51265ea65b31fae Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Fri, 11 Dec 2020 14:35:06 -0500 Subject: [PATCH] merge pillar with the defaults https://github.com/Security-Onion-Solutions/securityonion/issues/2319 --- salt/zeek/policy/securityonion/file-extraction/extract.zeek | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/zeek/policy/securityonion/file-extraction/extract.zeek b/salt/zeek/policy/securityonion/file-extraction/extract.zeek index e23c44a92..e5b7db864 100644 --- a/salt/zeek/policy/securityonion/file-extraction/extract.zeek +++ b/salt/zeek/policy/securityonion/file-extraction/extract.zeek @@ -1,5 +1,5 @@ -{%- import_yaml "zeek/fileextraction_defaults.yaml" as zeek_default %} -{%- set zeek = salt['grains.filter_by'](zeek_default, default='zeek', merge=salt['pillar.get']('zeek', {})) %} +{% import_yaml "zeek/fileextraction_defaults.yaml" as zeek_default -%} +{% set zeek = salt['grains.filter_by'](zeek_default, default='zeek', merge=salt['pillar.get']('zeek', {})) -%} # Directory to stage Zeek extracted files before processing redef FileExtract::prefix = "/nsm/zeek/extracted/"; # Set a limit to the file size @@ -7,7 +7,7 @@ redef FileExtract::default_limit = 9000000; # These are the mimetypes we want to rip off the networks export { global _mime_whitelist: table[string] of string = { - {%- for li in zeek.zeek.policy.file_extraction %} + {%- for li in zeek.policy.file_extraction %} {%- if not loop.last %} {%- for k,v in li.items() %} ["{{ k }}"] = "{{ v }}",