CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12584 from Security-Onion-Solutions/jertel/suripcap

Browse Source 
handle airgap when detections not enabled
This commit is contained in:
Jason Ertel
2024-03-13 21:35:06 -04:00
committed by GitHub
parent cc1356c823 844cfe55cd
commit 09bff01d79
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
salt/soc/merged.map.jinja
View File

@@ -35,18 +35,16 @@
{% do SOCMERGED.config.server.modules.pop('elastalertengine') %} {% do SOCMERGED.config.server.modules.pop('elastalertengine') %}
{% do SOCMERGED.config.server.modules.pop('strelkaengine') %} {% do SOCMERGED.config.server.modules.pop('strelkaengine') %}
{% do SOCMERGED.config.server.modules.pop('suricataengine') %} {% do SOCMERGED.config.server.modules.pop('suricataengine') %}
{% elif pillar.global.airgap %}
{# if system is Airgap, don't autoupdate Yara & Sigma rules #}
{% do SOCMERGED.config.server.modules.elastalertengine.update({'autoUpdateEnabled': false}) %}
{% do SOCMERGED.config.server.modules.strelkaengine.update({'autoUpdateEnabled': false}) %}
{% endif %} {% endif %}
{% if pillar.manager.playbook == 0 %} {% if pillar.manager.playbook == 0 %}
{% do SOCMERGED.config.server.client.inactiveTools.append('toolPlaybook') %} {% do SOCMERGED.config.server.client.inactiveTools.append('toolPlaybook') %}
{% endif %} {% endif %}
{# if system is Airgap, don't autoupdate Yara & Sigma rules #}
{% if pillar.global.airgap %}
{% do SOCMERGED.config.server.modules.elastalertengine.update({'autoUpdateEnabled': false}) %}
{% do SOCMERGED.config.server.modules.strelkaengine.update({'autoUpdateEnabled': false}) %}
{% endif %}
{% set standard_actions = SOCMERGED.config.pop('actions') %} {% set standard_actions = SOCMERGED.config.pop('actions') %}
{% if pillar.global.endgamehost != '' %} {% if pillar.global.endgamehost != '' %}