CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Change how pcap is written to the minion file

Browse Source
This commit is contained in:
Mike Reeves
2022-09-14 11:00:22 -04:00
parent a4dc63f3a4
commit 0a40bfcb88
3 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
salt/common/tools/sbin/so-minion
View File

@@ -168,13 +168,6 @@ function add_sensor_to_minion() {
echo " config:" >> $PILLARFILE
echo " af-packet:" >> $PILLARFILE
echo " threads: $CORECOUNT" >> $PILLARFILE
echo "steno:" >> $PILLARFILE
echo " stenopin: False" >> $PILLARFILE
echo " stenopins:" >> $PILLARFILE
echo " - 3" >> $PILLARFILE
echo " enabled: True" >> $PILLARFILE
echo " disks:" >> $PILLARFILE
echo " - '/some/path'" >> $PILLARFILE
}
function createSTANDALONE() {

11
salt/pcap/defaults.yaml Normal file
View File

@@ -0,0 +1,11 @@
pcap:
enabled: True
config:
maxdirectoryfiles: 30000
diskfreepercentage: 10
blocks: 2048
preallocate_file_mb: 4096
aiops: 128
stenopin: False
stenopins: []
disks: []

8
salt/pcap/soc_pcap.yaml
View File

@@ -1,9 +1,9 @@
pcap:
enabled:
description: Enable or Disable Stenographer on all sensors or a single sensor
config:
enabled:
description: Enable or Disable Stenographer on all sensors or a single sensor
maxfiles:
description: The maximum number of packet/index files to create before cleaning old ones up.
maxdirectoryfiles:
description: The maximum number of packet/index files to create before deleting old files. The default is about 8 days regardless of free space.
diskfreepercentage:
description: The disk space percent to always keep free for pcap
blocks: