From 2663ca87a2f3c77f6b0098ee30986435c2086bea Mon Sep 17 00:00:00 2001 From: Josh Patterson Date: Fri, 14 Aug 2026 09:19:11 -0400 Subject: [PATCH] Mark the mail-only zeekctl settings read only MailTo, MailConnectionSummary and MailHostUpDown do nothing but send mail, and the Zeek container has no mail program, so nothing they control can happen. Mark them read only rather than offering knobs in SOC that cannot take effect. MailConnectionSummary only gates the emailed copy; the connection summary is generated and archived either way. MailTo also feeds Notice::mail_dest, but Security Onion never enables the notice email action, so that half is inert too. MailHostUpDown gates only the notification text - host status detection, the plugin hook and the stored state all run regardless. MinDiskSpace stays editable. It is not mail only: setting it to 0 skips the disk space check entirely, and the warning it produces is not emailed but does appear in the output of "zeekctl cron". Correct its description, and MailHostUpDown's, which both claimed these settings have no visible effect. --- salt/zeek/soc_zeek.yaml | 36 ++++++++++++++++++++++++++++-------- 1 file changed, 28 insertions(+), 8 deletions(-) diff --git a/salt/zeek/soc_zeek.yaml b/salt/zeek/soc_zeek.yaml index c03203623..52934b044 100644 --- a/salt/zeek/soc_zeek.yaml +++ b/salt/zeek/soc_zeek.yaml @@ -87,23 +87,43 @@ zeek: advanced: True MinDiskSpace: description: >- - Percentage of free disk space below which ZeekControl reports a warning, or 0 to disable the check. - Note that this setting only sends email and the Zeek container does not include a mail program, - so it currently has no visible effect. It never deletes anything - disk based cleanup is handled - separately by so-sensor-clean. + Percentage of free disk space below which ZeekControl reports a warning, or 0 to disable the check + entirely. The Zeek container does not include a mail program, so the warning is not emailed - it + appears in the output of "zeekctl cron" instead. This setting never deletes anything - cleanup based + on disk usage is handled separately by so-sensor-clean. regex: ^([0-9]|[1-9][0-9]|100)$ regexFailureMessage: You must enter a percentage between 0 and 100. helpLink: zeek advanced: True - MailHostUpDown: + MailTo: description: >- - Set to 1 to send email when a Zeek node changes between the up and down states. - Note that this setting only sends email and the Zeek container does not include a mail program, - so it currently has no visible effect. + Address that ZeekControl would send mail to, covering cron output and crash reports, and the address + Zeek's notice framework would use. The Zeek container does not include a mail program, and Security + Onion never enables the notice email action, so no mail is sent and this address is unused. It is + read only for that reason. + helpLink: zeek + advanced: True + readonly: True + MailConnectionSummary: + description: >- + Set to 1 to email the hourly connection summary. This only controls the emailed copy - the summary is + generated and archived with the other Zeek logs either way. The Zeek container does not include a mail + program, so no mail is sent and this setting has no effect. It is read only for that reason. regex: ^[01]$ regexFailureMessage: You must enter 0 or 1. helpLink: zeek advanced: True + readonly: True + MailHostUpDown: + description: >- + Set to 1 to report when a Zeek node changes between the up and down states. The Zeek container does + not include a mail program, so this notification cannot be emailed. It is read only for that reason. + Host status detection still runs regardless of this setting - only the notification is affected. + regex: ^[01]$ + regexFailureMessage: You must enter 0 or 1. + helpLink: zeek + advanced: True + readonly: True policy: custom: filters: