From 33c23c30d32c27ad8ced37f9932e6031998d69bc Mon Sep 17 00:00:00 2001
From: Corey Ogburn <corey.ogburn@securityonionsolutions.com>
Date: Mon, 30 Jun 2025 11:43:02 -0600
Subject: [PATCH] Refactors playbook repo configuration

Replaces individual playbook repo fields with an array of repos to support multiple playbook sources. Refactor Jinja.
---
 salt/soc/defaults.yaml    | 14 +++++++++-----
 salt/soc/merged.map.jinja |  6 +++---
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 66355fa24..42e07a7c0 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1464,12 +1464,16 @@ soc:
           autoUpdateEnabled: true
           playbookImportFrequencySeconds: 86400
           playbookImportErrorSeconds: 600
-          playbookRepoUrl:
-            default: https://github.com/Security-Onion-Solutions/securityonion-resources-playbooks
-            airgap: file:///nsm/airgap-resources/playbooks/securityonion-resources-playbooks
-          playbookRepoBranch: main
           playbookRepoPath: /opt/sensoroni/playbooks/
-          playbookPathInRepo: securityonion-normalized
+          playbookRepos:
+            default:
+              - repo: https://github.com/Security-Onion-Solutions/securityonion-resources-playbooks
+                branch: main
+                folder: securityonion-normalized
+            airgap:
+              - repo: file:///nsm/airgap-resources/playbooks/securityonion-resources-playbooks
+                branch: main
+                folder: securityonion-normalized
         salt:
           queueDir: /opt/sensoroni/queue
           timeoutMs: 45000
diff --git a/salt/soc/merged.map.jinja b/salt/soc/merged.map.jinja
index c950d8a60..e053ce63f 100644
--- a/salt/soc/merged.map.jinja
+++ b/salt/soc/merged.map.jinja
@@ -61,11 +61,11 @@
 {%   do SOCMERGED.config.server.update({'airgapEnabled': false}) %}
 {% endif %}
 
-{# set playbookRepoUrl based on airgap or not #}
+{# set playbookRepos based on airgap or not #}
 {% if GLOBALS.airgap %}
-{%   do SOCMERGED.config.server.modules.playbook.update({'playbookRepoUrl': SOCMERGED.config.server.modules.playbook.playbookRepoUrl.airgap}) %}
+{%   do SOCMERGED.config.server.modules.playbook.update({'playbookRepos': SOCMERGED.config.server.modules.playbook.playbookRepos.airgap}) %}
 {% else %}
-{%   do SOCMERGED.config.server.modules.playbook.update({'playbookRepoUrl': SOCMERGED.config.server.modules.playbook.playbookRepoUrl.default}) %}
+{%   do SOCMERGED.config.server.modules.playbook.update({'playbookRepos': SOCMERGED.config.server.modules.playbook.playbookRepos.default}) %}
 {% endif %}
 
 {# remove these modules if detections is disabled #}