From 477181036112e7d8929e8cf0f5b4a835c2d4cad1 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Wed, 15 May 2024 19:10:50 -0400
Subject: [PATCH] exclude detect-parse errors

---
 salt/common/tools/sbin/so-log-check | 1 +
 salt/suricata/soc_suricata.yaml     | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/salt/common/tools/sbin/so-log-check b/salt/common/tools/sbin/so-log-check
index 67eff6d54..5bee4d254 100755
--- a/salt/common/tools/sbin/so-log-check
+++ b/salt/common/tools/sbin/so-log-check
@@ -202,6 +202,7 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|parsing_exception"            # Elastalert EQL parsing issue. Temp.
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|context deadline exceeded"
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Error running query:"         # Specific issues with detection rules
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|detect-parse"                 # Suricata encountering a malformed rule
 fi
 
 RESULT=0
diff --git a/salt/suricata/soc_suricata.yaml b/salt/suricata/soc_suricata.yaml
index 75ad1e476..e157ff852 100644
--- a/salt/suricata/soc_suricata.yaml
+++ b/salt/suricata/soc_suricata.yaml
@@ -12,7 +12,7 @@ suricata:
       title: SIDS
       helpLink: suricata.html
       readonlyUi: True
-      advanced: true
+      advanced: True
   classification:
     classification__config:
       description: Classifications config file.