add new pcap annotations

salt/sensoroni/defaults.yaml

@@ -8,6 +8,8 @@ sensoroni:
     node_checkin_interval_ms: 10000
     sensoronikey:
     soc_host:
+    suripcap:
+      pcapMaxCount: 999999
   analyzers:
       echotrail:
         base_url: https://api.echotrail.io/insights/

salt/sensoroni/files/sensoroni.json

@@ -39,7 +39,8 @@
       "suriquery": {
         "executablePath": "/opt/sensoroni/scripts/suriquery.sh",
         "pcapInputPath": "/nsm/suripcap",
-        "pcapOutputPath": "/nsm/pcapout"
+        "pcapOutputPath": "/nsm/pcapout",
+        "pcapMaxCount": {{ SENSORONIMERGED.config.suripcap.pcapMaxCount }}
       }
 {%    endif %}
 {%- else %}

salt/sensoroni/soc_sensoroni.yaml

@@ -37,6 +37,11 @@ sensoroni:
       helpLink: grid.html
       global: True
       advanced: True
+    suripcap:
+      pcapMaxCount:
+        description: The maximum number of PCAP packets to extract from eligible PCAP files, for PCAP jobs. If there are issues fetching excessively large packet streams consider lowering this value to reduce the number of collected packets returned to the user interface.
+        helpLink: sensoroni.html
+        advanced: True
   analyzers:
     echotrail:
       api_key:

salt/soc/defaults.yaml

@@ -1103,6 +1103,7 @@ soc:
           esSearchOffsetMs: 1800000
           maxLogLength: 1024
           asyncThreshold: 10
+          lookupTunnelParent: true
         influxdb:
           hostUrl:
           token:

salt/soc/soc_soc.yaml

@@ -126,6 +126,9 @@ soc:
             description: Maximum number of events that can be acknowledged synchronously. When acknowledging large numbers of events, where the count exceeds this value, the acknowledge update will be performed in the background, as it can take several minutes to complete.
             global: True
             advanced: True
+          lookupTunnelParent:
+            description: When true, if a pivoted event appears to be encapsulated, such as in a VxLan packet, then SOC will pivot to the VxLan packet stream. This can be useful if the PCAP parser is unable to locate the encapsulated packets. However, if the parser is written in a way that it can find a given filter even if its encapsulated, this is best left to false, as the analyst will see the intended packet data rather than the wrapping packet data.
+            global: True
         sostatus:
           refreshIntervalMs:
             description: Duration (in milliseconds) between refreshes of the grid status. Shortening this duration may not have expected results, as the backend systems feeding this sostatus data will continue their updates as scheduled.