From 3b32eb539f4f95e9b9e88d0169c05373d6b9dccd Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Tue, 23 Feb 2021 11:21:23 -0500
Subject: [PATCH] Copy latest rules when using airgaps

---
 salt/common/tools/sbin/soup | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup
index 31b1219f1..accc615a8 100755
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -379,6 +379,10 @@ unmount_update() {
   umount /tmp/soagupdate
 }
 
+update_airgap_rules() {
+  # Copy the rules over to update them for airgap.
+  rsync -av $UPDATE_DIR/SecurityOnion/agrules/* /nsm/repo/rules/
+}
 
 update_centos_repo() {
   # Update the files in the repo
@@ -588,6 +592,11 @@ echo "Making pillar changes."
 pillar_changes
 echo ""
 
+if [ $is_airgap -eq 0 ]; then
+  echo "Updating Rule Files to the Latest."
+  update_airgap_rules
+fi
+
 # Only update the repo if its airgap
 if [[ $is_airgap -eq 0 ]] && [[ "$UPGRADESALT" != "1" ]]; then
 update_centos_repo