CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 10:12:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Re-Work IDSTOOLS

Browse Source
This commit is contained in:
Mike Reeves
2023-03-15 16:33:33 -04:00
parent b809b22566
commit 0d30c14561
3 changed files with 25 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/idh/init.sls
View File

@@ -74,6 +74,8 @@ so-idh:
- file: opencanary_config - file: opencanary_config
- require: - require:
- file: opencanary_config - file: opencanary_config
- extra_hosts:
- {{ GLOBALS.manager }}:{{ GLOBALS.manager_ip }}
append_so-idh_so-status.conf: append_so-idh_so-status.conf:
file.append: file.append:

5
salt/idstools/defaults.yaml Normal file
View File

@@ -0,0 +1,5 @@
idstools:
config:
urls: []
ruleset: ETOPEN
oinkcode:

39
salt/idstools/etc/rulecat.conf
View File

@@ -1,17 +1,14 @@
{%- set URLS = salt['pillar.get']('idstools:config:urls') -%} {%- from 'vars/globals.map.jinja' import GLOBALS %}
{%- set RULESET = salt['pillar.get']('idstools:config:ruleset') -%} {%- import_yaml 'idstools/defaults.yaml' as IDSTOOLSDEFAULTS %}
{%- set OINKCODE = salt['pillar.get']('idstools:config:oinkcode', '' ) -%} {%- set IDSTOOLSMERGED = salt['pillar.get']('idstools:config', IDSTOOLSDEFAULTS.config, merge=True) %}
{%- set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') -%} {%- if GLOBALS.airgap is sameas true -%}
{%- set MANAGERIP = salt['pillar.get']('global:managerip', '') -%}
{%- set ENGINE = salt['pillar.get']('global:mdengine', '') %}
{%- if ISAIRGAP is sameas true -%}
--merged=/opt/so/rules/nids/all.rules --merged=/opt/so/rules/nids/all.rules
--local=/opt/so/rules/nids/local.rules --local=/opt/so/rules/nids/local.rules
{%- if ENGINE == "SURICATA" %} {%- if GLOBAL.md_engine == "SURICATA" %}
--local=/opt/so/rules/nids/sorules/extraction.rules --local=/opt/so/rules/nids/sorules/extraction.rules
--local=/opt/so/rules/nids/sorules/filters.rules --local=/opt/so/rules/nids/sorules/filters.rules
{%- endif %} {%- endif %}
--url=http://{{ MANAGERIP }}:7788/rules/emerging-all.rules --url=http://{{ GLOBALS.manager }}:7788/rules/emerging-all.rules
--disable=/opt/so/idstools/etc/disable.conf --disable=/opt/so/idstools/etc/disable.conf
--enable=/opt/so/idstools/etc/enable.conf --enable=/opt/so/idstools/etc/enable.conf
--modify=/opt/so/idstools/etc/modify.conf --modify=/opt/so/idstools/etc/modify.conf
@@ -19,23 +16,23 @@
--suricata-version=6.0 --suricata-version=6.0
--merged=/opt/so/rules/nids/all.rules --merged=/opt/so/rules/nids/all.rules
--local=/opt/so/rules/nids/local.rules --local=/opt/so/rules/nids/local.rules
{%- if ENGINE == "SURICATA" %} {%- if GLOBALS.md_engine == "SURICATA" %}
--local=/opt/so/rules/nids/sorules/extraction.rules --local=/opt/so/rules/nids/sorules/extraction.rules
--local=/opt/so/rules/nids/sorules/filters.rules --local=/opt/so/rules/nids/sorules/filters.rules
{%- endif %} {%- endif %}
--disable=/opt/so/idstools/etc/disable.conf --disable=/opt/so/idstools/etc/disable.conf
--enable=/opt/so/idstools/etc/enable.conf --enable=/opt/so/idstools/etc/enable.conf
--modify=/opt/so/idstools/etc/modify.conf --modify=/opt/so/idstools/etc/modify.conf
{%- if RULESET == 'ETOPEN' %} {%- if IDSTOOLSMERGED.ruleset == 'ETOPEN' %}
--etopen --etopen
{%- elif RULESET == 'ETPRO' %} {%- elif IDSTOOLSMERGED.ruleset == 'ETPRO' %}
--etpro={{ OINKCODE }} --etpro={{ IDSTOOLSMERGED.oinkcode }}
{%- elif RULESET == 'TALOS' %} {%- elif IDSTOOLSMERGED.ruleset == 'TALOS' %}
--url=https://www.snort.org/rules/snortrules-snapshot-2983.tar.gz?oinkcode={{ OINKCODE }} --url=https://www.snort.org/rules/snortrules-snapshot-2983.tar.gz?oinkcode={{ IDSTOOLSMERGED.oinkcode }}
{%- endif %} {%- endif %}
{%- endif %} {%- endif %}
{%- if URLS != None %} {%- if IDSTOOLSMERGED.urls | length > 0 %}
{%- for URL in URLS %} {%- for URL in IDSTOOLSMERGED.urls %}
--url={{ URL }} --url={{ URL }}
{%- endfor %} {%- endfor %}
{%- endif %} {%- endif %}