CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-09 10:42:54 +01:00
Code Issues Packages Projects Releases Wiki Activity

2.4 strelka

Browse Source
This commit is contained in:
m0duspwnens
2023-03-10 17:32:14 -05:00
parent d75866caec
commit 58343e39fa
21 changed files with 706 additions and 604 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/strelka/filecheck/defaults.yaml Normal file
View File

@@ -0,0 +1,4 @@
filecheck:
historypath: '/nsm/strelka/history/'
strelkapath: '/nsm/strelka/unprocessed/'
logfile: '/opt/so/log/strelka/filecheck.log'

10
salt/strelka/filecheck/filecheck.yaml
View File

@@ -1,10 +0,0 @@
{%- set ENGINE = salt['pillar.get']('global:mdengine', '') %}
filecheck:
{%- if ENGINE == "SURICATA" %}
extract_path: '/nsm/suricata/extracted'
{%- else %}
extract_path: '/nsm/zeek/extracted/complete'
{%- endif %}
historypath: '/nsm/strelka/history/'
strelkapath: '/nsm/strelka/unprocessed/'
logfile: '/opt/so/log/strelka/filecheck.log'

1
salt/strelka/filecheck/filecheck.yaml.jinja Normal file
View File

@@ -0,0 +1 @@
{{ FILECHECKCONFIG | yaml(false) }}

12
salt/strelka/filecheck/map.jinja Normal file
View File

@@ -0,0 +1,12 @@
{% from 'vars/globals.map.jinja' import GLOBALS %}
{% import_yaml 'strelka/filecheck/defaults.yaml' as FILECHECKDEFAULTS %}
{% if GLOBALS.md_engine == "SURICATA" %}
{% set extract_path = '/nsm/suricata/extracted' %}
{% set filecheck_runas = 'suricata' %}
{% else %}
{% set extract_path = '/nsm/zeek/extracted/complete' %}
{% set filecheck_runas = 'socore' %}
{% endif %}
{% do FILECHECKDEFAULTS.filecheck.update({'extract_path': extract_path}) %}