From 11fb33fdeb942aadebcc0a4664b130f514223628 Mon Sep 17 00:00:00 2001
From: Corey Ogburn <corey.ogburn@securityonionsolutions.com>
Date: Mon, 19 May 2025 14:19:56 -0600
Subject: [PATCH] Add RulesetName to Rule Repos

Fill in `rulesetName` in the rules repos of the ElastAlert and Strelka engines. These will act as an example to anybody adding their repos to these lists. The field is not required, but helps avoid collisions when managing repos as the value is used for the folder name. When not present, the final folder of the repo url is used as the rulesetName and as the folder name on disk.

Note that rulesetNames including a `/` will create extra folders in the path but the rulesetName will contain the slash, i.e. `rulesetName="joesecurity/sigma-rules"` will create the nested structure of `reposFolder/joesecurity/sigma-rules" containing the contents of the repo. All rules imported from this repo will have the ruleset of `joesecurity/sigma-rules`.
---
 salt/soc/defaults.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index fe190ea69..d756489e1 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1415,17 +1415,21 @@ soc:
                 license: Elastic-2.0
                 folder: sigma/stable
                 community: true
+                rulesetName: securityonion-resources
               - repo: file:///nsm/rules/custom-local-repos/local-sigma
                 license: Elastic-2.0
                 community: false
+                rulesetName: local-sigma
             airgap:
               - repo: file:///nsm/rules/detect-sigma/repos/securityonion-resources
                 license: Elastic-2.0
                 folder: sigma/stable
                 community: true
+                rulesetName: securityonion-resources
               - repo: file:///nsm/rules/custom-local-repos/local-sigma
                 license: Elastic-2.0
                 community: false
+                rulesetName: local-sigma
           sigmaRulePackages:
             - core
             - emerging_threats_addon
@@ -1500,16 +1504,20 @@ soc:
               - repo: https://github.com/Security-Onion-Solutions/securityonion-yara
                 license: DRL
                 community: true
+                rulesetName: securityonion-yara
               - repo: file:///nsm/rules/custom-local-repos/local-yara
                 license: Elastic-2.0
                 community: false
+                rulesetName: local-yara
             airgap:
               - repo: file:///nsm/rules/detect-yara/repos/securityonion-yara
                 license: DRL
                 community: true
+                rulesetName: securityonion-yara
               - repo: file:///nsm/rules/custom-local-repos/local-yara
                 license: Elastic-2.0
                 community: false
+                rulesetName: local-yara
           yaraRulesFolder: /opt/sensoroni/yara/rules
           stateFilePath: /opt/sensoroni/fingerprints/strelkaengine.state
           integrityCheckFrequencySeconds: 1200