Merge pull request #12511 from Security-Onion-Solutions/jertel/annotations

PCAP annotations

salt/sensoroni/defaults.yaml

@@ -8,6 +8,8 @@ sensoroni:
     node_checkin_interval_ms: 10000
     sensoronikey:
     soc_host:
+    suripcap:
+      pcapMaxCount: 999999
   analyzers:
       echotrail:
         base_url: https://api.echotrail.io/insights/

salt/sensoroni/files/sensoroni.json

@@ -39,7 +39,8 @@
       "suriquery": {
         "executablePath": "/opt/sensoroni/scripts/suriquery.sh",
         "pcapInputPath": "/nsm/suripcap",
-        "pcapOutputPath": "/nsm/pcapout"
+        "pcapOutputPath": "/nsm/pcapout",
+        "pcapMaxCount": {{ SENSORONIMERGED.config.suripcap.pcapMaxCount }}
       }
 {%    endif %}
 {%- else %}

salt/sensoroni/soc_sensoroni.yaml

@@ -37,6 +37,11 @@ sensoroni:
       helpLink: grid.html
       global: True
       advanced: True
+    suripcap:
+      pcapMaxCount:
+        description: The maximum number of PCAP packets to extract from eligible PCAP files, for PCAP jobs. If there are issues fetching excessively large packet streams consider lowering this value to reduce the number of collected packets returned to the user interface.
+        helpLink: sensoroni.html
+        advanced: True
   analyzers:
     echotrail:
       api_key:

salt/soc/defaults.yaml

@@ -1103,6 +1103,7 @@ soc:
           esSearchOffsetMs: 1800000
           maxLogLength: 1024
           asyncThreshold: 10
+          lookupTunnelParent: true
         influxdb:
           hostUrl:
           token:

salt/soc/soc_soc.yaml

@@ -126,6 +126,9 @@ soc:
             description: Maximum number of events that can be acknowledged synchronously. When acknowledging large numbers of events, where the count exceeds this value, the acknowledge update will be performed in the background, as it can take several minutes to complete.
             global: True
             advanced: True
+          lookupTunnelParent:
+            description: When true, if a pivoted event appears to be encapsulated, such as in a VXLAN packet, then SOC will pivot to the VXLAN packet stream. When false, SOC will attempt to pivot to the encapsulated packet stream itself, but at the risk that it may be unable to locate it in the stored PCAP data.
+            global: True
         sostatus:
           refreshIntervalMs:
             description: Duration (in milliseconds) between refreshes of the grid status. Shortening this duration may not have expected results, as the backend systems feeding this sostatus data will continue their updates as scheduled.