From 2a6cc58306d91ebf5c7b1b44c6958f5d793924fe Mon Sep 17 00:00:00 2001 From: Josh Brower Date: Wed, 1 Jul 2026 09:07:02 -0400 Subject: [PATCH] Simplify mappings --- salt/soc/config.sls | 8 ++++++++ salt/soc/enabled.sls | 2 ++ salt/soc/files/soc/playbook_placeholder_map.yaml | 6 +++--- .../files/soc/playbook_placeholder_map_custom.yaml | 14 ++++++++++++++ salt/soc/soc_soc.yaml | 10 +++++++++- 5 files changed, 36 insertions(+), 4 deletions(-) create mode 100644 salt/soc/files/soc/playbook_placeholder_map_custom.yaml diff --git a/salt/soc/config.sls b/salt/soc/config.sls index 14fdd6288..3609b7024 100644 --- a/salt/soc/config.sls +++ b/salt/soc/config.sls @@ -150,6 +150,14 @@ socplaybookplaceholdermap: - group: 939 - mode: 600 +socplaybookplaceholdermapcustom: + file.managed: + - name: /opt/so/conf/soc/playbook_placeholder_map_custom.yaml + - source: salt://soc/files/soc/playbook_placeholder_map_custom.yaml + - user: 939 + - group: 939 + - mode: 600 + socbanner: file.managed: - name: /opt/so/conf/soc/banner.md diff --git a/salt/soc/enabled.sls b/salt/soc/enabled.sls index bdd6d25d7..d84e24dd8 100644 --- a/salt/soc/enabled.sls +++ b/salt/soc/enabled.sls @@ -48,6 +48,7 @@ so-soc: - /opt/so/conf/soc/sigma_playbook_pipeline.yaml:/opt/sensoroni/sigma_playbook_pipeline.yaml:ro - /opt/so/conf/soc/sigma_final_pipeline.yaml:/opt/sensoroni/sigma_final_pipeline.yaml:rw - /opt/so/conf/soc/playbook_placeholder_map.yaml:/opt/sensoroni/playbook_placeholder_map.yaml:ro + - /opt/so/conf/soc/playbook_placeholder_map_custom.yaml:/opt/sensoroni/playbook_placeholder_map_custom.yaml:rw - /opt/so/conf/soc/custom.js:/opt/sensoroni/html/js/custom.js:ro - /opt/so/conf/soc/custom_roles:/opt/sensoroni/rbac/custom_roles:ro - /opt/so/conf/soc/soc_users_roles:/opt/sensoroni/rbac/users_roles:rw @@ -102,6 +103,7 @@ so-soc: - file: socusersroles - file: socclientsroles - file: socplaybookplaceholdermap + - file: socplaybookplaceholdermapcustom delete_so-soc_so-status.disabled: file.uncomment: diff --git a/salt/soc/files/soc/playbook_placeholder_map.yaml b/salt/soc/files/soc/playbook_placeholder_map.yaml index 582f052dc..eeddb4474 100644 --- a/salt/soc/files/soc/playbook_placeholder_map.yaml +++ b/salt/soc/files/soc/playbook_placeholder_map.yaml @@ -1,4 +1,4 @@ -# Global playbook placeholder map: %token% -> event field path. +# Global Playbook placeholder map: %token% -> event field path. # # Loaded by the SOC Playbook module and used to resolve `field|expand:%placeholder%` values # from an alert when converting playbook questions to OQL. @@ -9,8 +9,8 @@ # Example: with `src_ip: source.ip` (below), a question that writes # `source.ip|expand: '%src_ip%'` resolves %src_ip% to the alert's source.ip at convert time. # -# This is the base layer - a playbook repo can extend it with a co-located *.placeholders.yaml -# config file that overlays these for that repo's playbooks. +# This is the global base layer. To add or override tokens edit playbook_placeholder_map_custom.yaml. +# those entries overlay this map and win on conflict. CommandLine: process.command_line CurrentDirectory: process.working_directory diff --git a/salt/soc/files/soc/playbook_placeholder_map_custom.yaml b/salt/soc/files/soc/playbook_placeholder_map_custom.yaml new file mode 100644 index 000000000..0d586db18 --- /dev/null +++ b/salt/soc/files/soc/playbook_placeholder_map_custom.yaml @@ -0,0 +1,14 @@ +# Custom Playbook placeholder map: %token% -> event field path. +# +# +# Left: the %token% used in a playbook question. +# Right: the event field its value is read from (event_data.-nested or bare; the module tries +# both). Note: a token that is simply named after a flat event field resolves automatically +# without an entry here - only add a mapping when the token name differs from the field name. +# +# Example: +# +# account_id: cloudflare.account_id +# +# A question that writes +# `account_id|expand: '%account_id%'` resolves %account_id% from the alert at convert time. diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index 19853196a..594dbf88c 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -46,7 +46,15 @@ soc: syntax: yaml file: True global: True - advanced: True + advanced: False + helpLink: security-onion-console-customization + playbook_placeholder_map_custom__yaml: + title: Playbook Placeholder Map + description: Custom mappings of Playbook %placeholder% tokens to event fields. + syntax: yaml + file: True + global: True + advanced: False helpLink: security-onion-console-customization config: licenseKey: