CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-08-20 22:48:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Mark the mail-only zeekctl settings read only

Browse Source 
MailTo, MailConnectionSummary and MailHostUpDown do nothing but send mail, and
the Zeek container has no mail program, so nothing they control can happen. Mark
them read only rather than offering knobs in SOC that cannot take effect.

MailConnectionSummary only gates the emailed copy; the connection summary is
generated and archived either way. MailTo also feeds Notice::mail_dest, but
Security Onion never enables the notice email action, so that half is inert too.
MailHostUpDown gates only the notification text - host status detection, the
plugin hook and the stored state all run regardless.

MinDiskSpace stays editable. It is not mail only: setting it to 0 skips the disk
space check entirely, and the warning it produces is not emailed but does appear
in the output of "zeekctl cron". Correct its description, and MailHostUpDown's,
which both claimed these settings have no visible effect.
This commit is contained in:
Josh Patterson
2026-08-14 09:19:11 -04:00
parent a337a3e4f6
commit 2663ca87a2
1 changed files with 28 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/zeek/soc_zeek.yaml
+28 -8
View File
@@ -87,23 +87,43 @@ zeek:
advanced: True
MinDiskSpace:
description: >-
Percentage of free disk space below which ZeekControl reports a warning, or 0 to disable the check.
Note that this setting only sends email and the Zeek container does not include a mail program,
so it currently has no visible effect. It never deletes anything - disk based cleanup is handled
separately by so-sensor-clean.
Percentage of free disk space below which ZeekControl reports a warning, or 0 to disable the check
entirely. The Zeek container does not include a mail program, so the warning is not emailed - it
appears in the output of "zeekctl cron" instead. This setting never deletes anything - cleanup based
on disk usage is handled separately by so-sensor-clean.
regex: ^([0-9]|[1-9][0-9]|100)$
regexFailureMessage: You must enter a percentage between 0 and 100.
helpLink: zeek
advanced: True
MailHostUpDown:
MailTo:
description: >-
Set to 1 to send email when a Zeek node changes between the up and down states.
Note that this setting only sends email and the Zeek container does not include a mail program,
so it currently has no visible effect.
Address that ZeekControl would send mail to, covering cron output and crash reports, and the address
Zeek's notice framework would use. The Zeek container does not include a mail program, and Security
Onion never enables the notice email action, so no mail is sent and this address is unused. It is
read only for that reason.
helpLink: zeek
advanced: True
readonly: True
MailConnectionSummary:
description: >-
Set to 1 to email the hourly connection summary. This only controls the emailed copy - the summary is
generated and archived with the other Zeek logs either way. The Zeek container does not include a mail
program, so no mail is sent and this setting has no effect. It is read only for that reason.
regex: ^[01]$
regexFailureMessage: You must enter 0 or 1.
helpLink: zeek
advanced: True
readonly: True
MailHostUpDown:
description: >-
Set to 1 to report when a Zeek node changes between the up and down states. The Zeek container does
not include a mail program, so this notification cannot be emailed. It is read only for that reason.
Host status detection still runs regardless of this setting - only the notification is affected.
regex: ^[01]$
regexFailureMessage: You must enter 0 or 1.
helpLink: zeek
advanced: True
readonly: True
policy:
custom:
filters: