CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 01:32:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

ensure /nsm/rules/yara directory exists

Browse Source
This commit is contained in:
m0duspwnens
2023-07-10 11:10:37 -04:00
parent 47b2481cdd
commit 1ac72e5b24
3 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
salt/manager/init.sls
View File

@@ -104,6 +104,12 @@ yara_update_scripts:
- defaults: - defaults:
EXCLUDEDRULES: {{ STRELKAMERGED.rules.excluded }} EXCLUDEDRULES: {{ STRELKAMERGED.rules.excluded }}
rules_dir:
file.directory:
- name: /nsm/rules/yara
- user: socore
- group: socore
{% if GLOBALS.airgap %} {% if GLOBALS.airgap %}
remove_strelka-yara-download: remove_strelka-yara-download:
cron.absent: cron.absent:

1
salt/manager/tools/sbin_jinja/so-yara-download
View File

@@ -11,6 +11,7 @@ export https_proxy={{ proxy }}
export no_proxy= salt['pillar.get']('manager:no_proxy') export no_proxy= salt['pillar.get']('manager:no_proxy')
{%- endif %} {%- endif %}
repos="/opt/so/conf/strelka/repos.txt"
outputdir=/nsm/rules/yara outputdir=/nsm/rules/yara
gh_status=$(curl -s -o /dev/null -w "%{http_code}" https://github.com) gh_status=$(curl -s -o /dev/null -w "%{http_code}" https://github.com)
clone_dir="/tmp" clone_dir="/tmp"

2
salt/manager/tools/sbin_jinja/so-yara-update
View File

@@ -9,12 +9,10 @@ NOROOT=1
echo "Starting to check for yara rule updates at $(date)..." echo "Starting to check for yara rule updates at $(date)..."
repos="/opt/so/conf/strelka/repos.txt"
newcounter=0 newcounter=0
excludedcounter=0 excludedcounter=0
excluded_rules=({{ EXCLUDEDRULES | join(' ') }}) excluded_rules=({{ EXCLUDEDRULES | join(' ') }})
# Pull down the SO Rules # Pull down the SO Rules
SORULEDIR=/nsm/rules/yara SORULEDIR=/nsm/rules/yara
OUTPUTDIR=/opt/so/saltstack/local/salt/strelka/rules OUTPUTDIR=/opt/so/saltstack/local/salt/strelka/rules