CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-01-06 16:23:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

test regexes for detections

Browse Source
This commit is contained in:
Jason Ertel
2024-05-06 19:03:12 -04:00
parent a67f0d93a0
commit 4ebe070cd8
3 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
setup/so-functions
View File

@@ -1257,6 +1257,13 @@ soc_pillar() {
" config:"\
" server:"\
" srvKey: '$SOCSRVKEY'"\
" modules:"\
" elastalertengine:"\
" allowRegex: '$ELASTALERT_ALLOW_REGEX'"\
" strelkaengine:"\
" allowRegex: '$STRELKA_ALLOW_REGEX'"\
" suricataengine:"\
" allowRegex: '$SURICATA_ALLOW_REGEX'"\
"" > "$soc_pillar_file"
if [[ $telemetry -ne 0 ]]; then

3
setup/so-setup
View File

@@ -245,6 +245,9 @@ if [ -n "$test_profile" ]; then
WEBUSER=onionuser@somewhere.invalid
WEBPASSWD1=0n10nus3r
WEBPASSWD2=0n10nus3r
STRELKA_ALLOW_REGEX="EquationGroup_Toolset_Apr17__ELV_.*"
ELASTALERT_ALLOW_REGEX="Security Onion"
SURICATA_ALLOW_REGEX="200033\\d"
update_sudoers_for_testing
fi