CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 18:22:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix Rulecat

Browse Source
This commit is contained in:
Mike Reeves
2020-09-09 18:38:07 -04:00
parent 7ebf93fcb5
commit 45b11b2321
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
salt/idstools/etc/rulecat.conf
View File

@@ -1,19 +1,29 @@
{%- set URLS = salt['pillar.get']('idstools:config:urls') -%} {%- set URLS = salt['pillar.get']('idstools:config:urls') -%}
{%- set RULESET = salt['pillar.get']('idstools:config:ruleset') -%} {%- set RULESET = salt['pillar.get']('idstools:config:ruleset') -%}
{%- set OINKCODE = salt['pillar.get']('idstools:config:oinkcode', '' ) -%} {%- set OINKCODE = salt['pillar.get']('idstools:config:oinkcode', '' ) -%}
{%- set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') -%}
{% if ISAIRGAP is sameas true %}
--merged=/opt/so/rules/nids/all.rules
--local=/opt/so/rules/nids/local.rules
--local=/opt/so/rules/nids/emerging-all.rules
--disable=/opt/so/idstools/etc/disable.conf
--enable=/opt/so/idstools/etc/enable.conf
--modify=/opt/so/idstools/etc/modify.conf
{%- else -%}
--suricata-version=5.0 --suricata-version=5.0
--merged=/opt/so/rules/nids/all.rules --merged=/opt/so/rules/nids/all.rules
--local=/opt/so/rules/nids/local.rules --local=/opt/so/rules/nids/local.rules
--disable=/opt/so/idstools/etc/disable.conf --disable=/opt/so/idstools/etc/disable.conf
--enable=/opt/so/idstools/etc/enable.conf --enable=/opt/so/idstools/etc/enable.conf
--modify=/opt/so/idstools/etc/modify.conf --modify=/opt/so/idstools/etc/modify.conf
{%- if RULESET == 'ETOPEN' %} {%- if RULESET == 'ETOPEN' -%}
--etopen --etopen
{%- elif RULESET == 'ETPRO' %} {%- elif RULESET == 'ETPRO' -%}
--etpro={{ OINKCODE }} --etpro={{ OINKCODE }}
{%- elif RULESET == 'TALOS' %} {%- elif RULESET == 'TALOS' -%}
--url=https://www.snort.org/rules/snortrules-snapshot-2983.tar.gz?oinkcode={{ OINKCODE }} --url=https://www.snort.org/rules/snortrules-snapshot-2983.tar.gz?oinkcode={{ OINKCODE }}
{%- endif %} {%- endif -%}
{%- endif -%}
{%- if URLS != None %} {%- if URLS != None %}
{%- for URL in URLS %} {%- for URL in URLS %}
--url={{ URL }} --url={{ URL }}