From 0c969312e2ee61eed8e6c0d571e44dc7ee7cdcec Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Mon, 29 Jan 2024 15:22:20 -0500
Subject: [PATCH] Add Globals

---
 salt/global/defaults.yaml           |  2 ++
 salt/global/soc_global.yaml         |  5 +++++
 salt/manager/tools/sbin/so-minion   |  3 ++-
 salt/sensoroni/files/sensoroni.json | 11 ++++++++++-
 salt/suricata/soc_suricata.yaml     |  4 +++-
 5 files changed, 22 insertions(+), 3 deletions(-)
 create mode 100644 salt/global/defaults.yaml

diff --git a/salt/global/defaults.yaml b/salt/global/defaults.yaml
new file mode 100644
index 000000000..bd7244a58
--- /dev/null
+++ b/salt/global/defaults.yaml
@@ -0,0 +1,2 @@
+global:
+  pcapengine: STENO
\ No newline at end of file
diff --git a/salt/global/soc_global.yaml b/salt/global/soc_global.yaml
index 14d637d50..fc1c09b1c 100644
--- a/salt/global/soc_global.yaml
+++ b/salt/global/soc_global.yaml
@@ -14,6 +14,11 @@ global:
     regex: ^(ZEEK|SURICATA)$
     regexFailureMessage: You must enter either ZEEK or SURICATA.
     global: True
+  pcapengine:
+    description: What engine to use for generating pcap. Options are STENO and SURICATA.
+    regex: ^(STENO|SURICATA)$
+    regexFailureMessage: You must enter either STENO or SURICATA.
+    global: True
   ids:
     description: Which IDS engine to use. Currently only Suricata is supported.
     global: True
diff --git a/salt/manager/tools/sbin/so-minion b/salt/manager/tools/sbin/so-minion
index 877796620..4995e1c9d 100755
--- a/salt/manager/tools/sbin/so-minion
+++ b/salt/manager/tools/sbin/so-minion
@@ -99,7 +99,8 @@ function pcapspace() {
 		"suricata:"\
 		"  config:"\
 		"    output:"\
-		"      pcap-log: $s" >> $PILLARFILE
+		"      pcap-log:"\
+		"        max-files: $s" >> $PILLARFILE
 	
 }
 
diff --git a/salt/sensoroni/files/sensoroni.json b/salt/sensoroni/files/sensoroni.json
index 59ce500e3..c5608ba56 100644
--- a/salt/sensoroni/files/sensoroni.json
+++ b/salt/sensoroni/files/sensoroni.json
@@ -23,13 +23,22 @@
       "importer": {},
       "statickeyauth": {
         "apiKey": "{{ GLOBALS.sensoroni_key }}"
-{%- if PCAPMERGED.enabled %} 
+{%- if PCAPMERGED.enabled %}
+{%-   if PCAPENGINE.steno %} 
       },     
       "stenoquery": {
         "executablePath": "/opt/sensoroni/scripts/stenoquery.sh",
         "pcapInputPath": "/nsm/pcap",
         "pcapOutputPath": "/nsm/pcapout"
       }
+{%- elif PCAPENGINE.suri %}
+      },     
+      "suriquery": {
+        "executablePath": "/opt/sensoroni/scripts/suriquery.sh",
+        "pcapInputPath": "/nsm/suripcap",
+        "pcapOutputPath": "/nsm/pcapout"
+      }
+{%- endif %}
 {%- else %}
       }
 {%- endif %}
diff --git a/salt/suricata/soc_suricata.yaml b/salt/suricata/soc_suricata.yaml
index 5dddd7442..7153eb9a1 100644
--- a/salt/suricata/soc_suricata.yaml
+++ b/salt/suricata/soc_suricata.yaml
@@ -155,8 +155,10 @@ suricata:
                 helpLink: suricata.html
       pcap-log:
         enabled:
-          description: Enable Suricata to collect PCAP.
+          description: This value is ignored by SO. pcapengine in globals takes predidence.
+          readonly: True
           helpLink: suricata.html
+          advanced: True
         compression: 
           description: Enable compression of Suricata PCAP. Currently unsupported
           advanced: True