enabled/disable zeek

salt/allowed_states.map.jinja

@@ -3,8 +3,6 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-
-{% set ZEEKVER = salt['pillar.get']('global:mdengine', '') %}
 {% set PLAYBOOK = salt['pillar.get']('manager:playbook', '0') %}
 {% set ELASTALERT = salt['pillar.get']('elastalert:enabled', True) %}
 {% set ELASTICSEARCH = salt['pillar.get']('elasticsearch:enabled', True) %}
@@ -221,7 +219,7 @@
     {% do allowed_states.append('mysql') %}
   {% endif %}
 
-  {%- if ZEEKVER != 'SURICATA' and grains.role in ['so-sensor', 'so-eval', 'so-standalone', 'so-heavynode'] %}
+  {%- if grains.role in ['so-sensor', 'so-eval', 'so-standalone', 'so-heavynode'] %}
     {% do allowed_states.append('zeek') %}
   {%- endif %}
 

salt/top.sls

@@ -3,8 +3,6 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-
-{% set ZEEKVER = salt['pillar.get']('global:mdengine', '') %}
 {% set PLAYBOOK = salt['pillar.get']('manager:playbook', '0') %}
 {% set ELASTALERT = salt['pillar.get']('elastalert:enabled', True) %}
 {% set ELASTICSEARCH = salt['pillar.get']('elasticsearch:enabled', True) %}
@@ -52,9 +50,7 @@ base:
     - pcap
     - suricata
     - healthcheck
-    {%- if ZEEKVER != 'SURICATA' %}
     - zeek
-    {%- endif %}
     {%- if STRELKA %}
     - strelka
     {%- endif %}
@@ -89,9 +85,7 @@ base:
     {%- endif %}
     - pcap
     - suricata
-    {%- if ZEEKVER != 'SURICATA' %}
     - zeek
-    {%- endif %}
     {%- if STRELKA %}
     - strelka
     {%- endif %}
@@ -183,9 +177,7 @@ base:
     {%- endif %}
     - pcap
     - suricata
-    {%- if ZEEKVER != 'SURICATA' %}
     - zeek
-    {%- endif %}
     {%- if STRELKA %}
     - strelka
     {%- endif %}
@@ -278,9 +270,7 @@ base:
     {%- endif %}
     - pcap
     - suricata
-    {%- if ZEEKVER != 'SURICATA' %}
     - zeek
-    {%- endif %}
     - elasticfleet.install_agent_grid
     - docker_clean
   

salt/zeek/config.map.jinja

@@ -1,3 +1,8 @@
+{# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+   or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
+   https://securityonion.net/license; you may not use this file except in compliance with the
+   Elastic License 2.0. #}
+
 {% from 'vars/sensor.map.jinja' import ROLE_GLOBALS %}
 {% import_yaml 'zeek/defaults.yaml' as ZEEKDEFAULTS with context %}
 {% set ZEEKMERGED = salt['pillar.get']('zeek', ZEEKDEFAULTS.zeek, merge=True) %}

salt/zeek/config.sls

@@ -8,9 +8,7 @@
 
 {% from 'vars/globals.map.jinja' import GLOBALS %}
 {% from "zeek/config.map.jinja" import ZEEKMERGED %}
-
 {% from 'bpf/zeek.map.jinja' import ZEEKBPF %}
-
 {% set BPF_STATUS = 0  %}
 
 # Add Zeek group

salt/zeek/disabled.sls

@@ -1,3 +1,8 @@
+# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
+# https://securityonion.net/license; you may not use this file except in compliance with the
+# Elastic License 2.0.
+
 {% from 'allowed_states.map.jinja' import allowed_states %}
 {% if sls.split('.')[0] in allowed_states %}
 

salt/zeek/enabled.sls

@@ -1,3 +1,8 @@
+# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
+# https://securityonion.net/license; you may not use this file except in compliance with the
+# Elastic License 2.0.
+
 {% from 'allowed_states.map.jinja' import allowed_states %}
 {% if sls.split('.')[0] in allowed_states %}
 

salt/zeek/init.sls

@@ -1,8 +1,13 @@
+# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
+# https://securityonion.net/license; you may not use this file except in compliance with the
+# Elastic License 2.0.
+
 {% from 'vars/globals.map.jinja' import GLOBALS %}
 {% from 'zeek/config.map.jinja' import ZEEKMERGED %}
 
 include:
-{% if ZEEKMERGED.enabled and GLOBALS.role != 'so-import'%}
+{% if ZEEKMERGED.enabled and GLOBALS.role != 'so-import' and GLOBALS.md_engine != 'SURICATA' %}
   - zeek.enabled
 {% elif GLOBALS.role == 'so-import' %}
   - zeek.config

salt/zeek/sostatus.sls

@@ -1,3 +1,8 @@
+# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
+# https://securityonion.net/license; you may not use this file except in compliance with the
+# Elastic License 2.0.
+
 {% from 'allowed_states.map.jinja' import allowed_states %}
 {% if sls.split('.')[0] in allowed_states %}