From e93e58fedb383a0a7487f7af7b0d884087da539f Mon Sep 17 00:00:00 2001 From: bryant-treacle Date: Wed, 26 Apr 2023 08:28:40 -0400 Subject: [PATCH 1/6] Update node.cfg.jinja --- salt/zeek/files/node.cfg.jinja | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/zeek/files/node.cfg.jinja b/salt/zeek/files/node.cfg.jinja index 9ef06bd5a..02b1518df 100644 --- a/salt/zeek/files/node.cfg.jinja +++ b/salt/zeek/files/node.cfg.jinja @@ -16,10 +16,10 @@ type=worker host=localhost interface=af_packet::{{ NODE.interface }} lb_method=custom - {%- if NODE.lb_procs %} -lb_procs={{ NODE.lb_procs }} - {%- else %} + {%- if NODE.pins %} lb_procs={{ NODE.pins | length }} + {%- else %} +lb_procs={{ NODE.lb_procs }} {%- endif %} {%- if NODE.pins %} pin_cpus={{ NODE.pins | join(", ") }} From f07f0775acfafb8743b173364bdc6bcf588b2f43 Mon Sep 17 00:00:00 2001 From: bryant-treacle Date: Wed, 26 Apr 2023 08:30:28 -0400 Subject: [PATCH 2/6] Update top.sls --- pillar/top.sls | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pillar/top.sls b/pillar/top.sls index 1acc5d030..9e373be31 100644 --- a/pillar/top.sls +++ b/pillar/top.sls @@ -18,7 +18,8 @@ base: '*_eval or *_heavynode or *_sensor or *_standalone or *_import': - match: compound - - zeek + - zeek.soc_zeek + - zeek.adv_zeek - bpf.soc_bpf - bpf.adv_bpf From 49a60bac765c3743399a000fbc786ea565326504 Mon Sep 17 00:00:00 2001 From: bryant-treacle Date: Wed, 26 Apr 2023 08:49:04 -0400 Subject: [PATCH 3/6] Update soc_idstools.yaml --- salt/idstools/soc_idstools.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/salt/idstools/soc_idstools.yaml b/salt/idstools/soc_idstools.yaml index bda436928..a7ccac207 100644 --- a/salt/idstools/soc_idstools.yaml +++ b/salt/idstools/soc_idstools.yaml @@ -7,6 +7,7 @@ idstools: ruleset: description: Define the ruleset you want to run. Options are ETOPEN or ETPRO. global: True + regex: ET[PO][RP][OE] helpLink: rules.html urls: description: This is a list of additional rule download locations. @@ -16,14 +17,20 @@ idstools: disabled: description: List of SIDS that you want to disable. global: True + multiline: True + forcedType: "[]string" helpLink: managing-alerts.html enabled: description: List of SIDS that are disabled by the rule source that you want to enable. global: True + multiline: True + forcedType: "[]string" helpLink: managing-alerts.html modify: description: List of SIDS that you want to modify. global: True + multiline: True + forcedType: "[]string" helpLink: managing-alerts.html rules: local__rules: From 12120e94c8f5c2b84f403f0bf2f308a1ed4a18aa Mon Sep 17 00:00:00 2001 From: bryant-treacle Date: Wed, 26 Apr 2023 09:32:08 -0400 Subject: [PATCH 4/6] Update soc_idstools.yaml --- salt/idstools/soc_idstools.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/idstools/soc_idstools.yaml b/salt/idstools/soc_idstools.yaml index a7ccac207..2a411004d 100644 --- a/salt/idstools/soc_idstools.yaml +++ b/salt/idstools/soc_idstools.yaml @@ -7,7 +7,7 @@ idstools: ruleset: description: Define the ruleset you want to run. Options are ETOPEN or ETPRO. global: True - regex: ET[PO][RP][OE] + regex: ETPRO\b|ETOPEN\b helpLink: rules.html urls: description: This is a list of additional rule download locations. From a8b8a1d0b76db7dd4ffa5f0c0088d26e74349360 Mon Sep 17 00:00:00 2001 From: bryant-treacle Date: Thu, 27 Apr 2023 15:32:37 -0400 Subject: [PATCH 5/6] Update soc_idstools.yaml --- salt/idstools/soc_idstools.yaml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/salt/idstools/soc_idstools.yaml b/salt/idstools/soc_idstools.yaml index 2a411004d..e0ad6ba98 100644 --- a/salt/idstools/soc_idstools.yaml +++ b/salt/idstools/soc_idstools.yaml @@ -1,11 +1,12 @@ idstools: config: oinkcode: - description: Enter your registration code for paid rulesets. + description: Enter your registration/oink code for paid NIDS rulesets. + title: registraion code global: True helpLink: rules.html ruleset: - description: Define the ruleset you want to run. Options are ETOPEN or ETPRO. + description: Defines the ruleset you want to run. Options are ETOPEN or ETPRO. global: True regex: ETPRO\b|ETOPEN\b helpLink: rules.html @@ -15,26 +16,28 @@ idstools: helpLink: rules.html sids: disabled: - description: List of SIDS that you want to disable. + description: Contains the list of NIDS rules manually disabled across the grid. To disable a rule, add its signature ID (SID) to the Current Grid Value box, one entry per line. To disable multiple rules, you can use regular expressions. global: True multiline: True forcedType: "[]string" + regex: \d*|re:.* helpLink: managing-alerts.html enabled: - description: List of SIDS that are disabled by the rule source that you want to enable. + description: Contains the list of NIDS rules manually enabled across the grid. To enable a rule, add its signature ID (SID) to the Current Grid Value box, one entry per line. To enable multiple rules, you can use regular expressions. global: True multiline: True forcedType: "[]string" + regex: \d*|re:.* helpLink: managing-alerts.html modify: - description: List of SIDS that you want to modify. + description: Contains the list of NIDS rules that were modified from their default values. Entries must adhere to the following format - SID "REGEX_SEARCH_TERM" "REGEX_REPLACE_TERM" global: True multiline: True forcedType: "[]string" helpLink: managing-alerts.html rules: local__rules: - description: This is where custom Suricata rules are entered. + description: Contains the list of custom NIDS rules applied to the grid. To add custom NIDS rules to the grid, enter one rule per line in the Current Grid Value box. file: True global: True advanced: True From 57d90a62f787fb811acaed00678c60278ca5c713 Mon Sep 17 00:00:00 2001 From: bryant-treacle Date: Thu, 27 Apr 2023 16:21:41 -0400 Subject: [PATCH 6/6] Update soc_zeek.yaml --- salt/zeek/soc_zeek.yaml | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/salt/zeek/soc_zeek.yaml b/salt/zeek/soc_zeek.yaml index 86c48712a..a3ad624b6 100644 --- a/salt/zeek/soc_zeek.yaml +++ b/salt/zeek/soc_zeek.yaml @@ -6,30 +6,36 @@ zeek: config: local: load: - description: List of Zeek policies to load + description: Contains a list of policies and scripts loaded by Zeek. Values in the Current Grid Value dialog box apply to every instance of Zeek. Values in a dialog box for a specific node will only apply to that node. forcedType: "[]string" helpLink: zeek.html load-sigs: - description: List of Zeek signatures to load + description: Contains a list of signatures loaded by Zeek. Values placed in the Current Grid Value dialog box apply to every instance of Zeek. Values placed in a dialog box for a specific node will only apply to that node. forcedType: "[]string" helpLink: zeek.html redef: - description: List of Zeek variables to redefine + description: List of Zeek variables to redefine. Values placed in the Current Grid Value dialog box apply to every instance of Zeek. Values placed in a dialog box for a specific node will only apply to that node. forcedType: "[]string" advanced: True helpLink: zeek.html node: lb_procs: - description: This is the number of CPUs to use for Zeek. This setting is ignored if you are using pins. + description: Contains the number of CPU cores or workers used by Zeek. This setting should only be applied to individual nodes and will be ignored if CPU affinity is enabled. + title: workers helpLink: zeek.html node: True pins_enabled: description: Enabling this setting allows you to pin Zeek to specific CPUs. + title: cpu affinity enabled + forcedType: bool helpLink: zeek.html node: True advanced: True pins: - description: This is a list of CPUs you want to pin Zeek to. + description: Contains a list of specific CPU cores pinned to Zeek workers. To set the CPU affinity, enter the processor ID number in the dialog box for the desired node. To retrieve the processor ID numbers, run the command "cat /proc/cpuinfo | grep processor" on the desired node. Please note that this setting should only be applied to individual nodes. + title: cpu affinity + multiline: True + forcedType: "[]string" helpLink: zeek.html node: True advanced: True @@ -47,5 +53,5 @@ zeek: global: True advanced: True file_extraction: - description: This is a list of MIME types that Zeek will extract from the network streams. + description: Contains a list of file or MIME types Zeek will extract from the network streams. Values must adhere to the following format - {"MIME_TYPE":"FILE_EXTENTION"} helpLink: zeek.html