Suricata Airgap

salt/idstools/enabled.sls

@@ -46,8 +46,9 @@ so-idstools:
       - {{ BIND }}
       {% endfor %}
     {% endif %}
-    {% if DOCKER.containers['so-idstools'].extra_hosts %}
     - extra_hosts:
+      - {{ GLOBALS.manager }}:{{ GLOBALS.manager_ip }}
+    {% if DOCKER.containers['so-idstools'].extra_hosts %}
       {% for XTRAHOST in DOCKER.containers['so-idstools'].extra_hosts %}
       - {{ XTRAHOST }}
       {% endfor %}

salt/idstools/tools/sbin_jinja/so-rule-update

@@ -23,9 +23,9 @@ docker exec so-idstools idstools-rulecat -v --suricata-version 6.0 -o /nsm/rules
 {%- endif %}
 
 
-#argstr=""
-#for arg in "$@"; do
-#    argstr="${argstr} \"${arg}\""
-#done
+argstr=""
+for arg in "$@"; do
+    argstr="${argstr} \"${arg}\""
+done
 
 docker exec so-idstools /bin/bash -c "cd /opt/so/idstools/etc && idstools-rulecat --force ${argstr}"