CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12431 from Security-Onion-Solutions/feature/brower-detections

Browse Source 
Add Detection AutoUpdate config
This commit is contained in:
Josh Brower
2024-02-26 08:43:33 -05:00
committed by GitHub
parent 77cb5748f6 a6bb7216f9
commit 66b815d4b2
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/soc/defaults.yaml
View File

@@ -1009,6 +1009,7 @@ soc:
kratos: kratos:
hostUrl: hostUrl:
elastalertengine: elastalertengine:
autoUpdateEnabled: false
communityRulesImportFrequencySeconds: 180 communityRulesImportFrequencySeconds: 180
elastAlertRulesFolder: /opt/sensoroni/elastalert elastAlertRulesFolder: /opt/sensoroni/elastalert
rulesFingerprintFile: /opt/sensoroni/fingerprints/sigma.fingerprint rulesFingerprintFile: /opt/sensoroni/fingerprints/sigma.fingerprint
@@ -1057,6 +1058,7 @@ soc:
userFiles: userFiles:
- rbac/users_roles - rbac/users_roles
strelkaengine: strelkaengine:
autoUpdateEnabled: false
compileYaraPythonScriptPath: /opt/so/conf/strelka/compile_yara.py compileYaraPythonScriptPath: /opt/so/conf/strelka/compile_yara.py
reposFolder: /opt/sensoroni/yara/repos reposFolder: /opt/sensoroni/yara/repos
rulesRepos: rulesRepos:

9
salt/soc/soc_soc.yaml
View File

@@ -75,6 +75,10 @@ soc:
description: 'Defines the Sigma Community Ruleset you want to run. One of these (core | core+ | core++ | all ) as well as an optional Add-on (emerging_threats_addon). WARNING! Changing the ruleset will remove all existing Sigma rules of the previous ruleset and their associated overrides. This removal cannot be undone.' description: 'Defines the Sigma Community Ruleset you want to run. One of these (core | core+ | core++ | all ) as well as an optional Add-on (emerging_threats_addon). WARNING! Changing the ruleset will remove all existing Sigma rules of the previous ruleset and their associated overrides. This removal cannot be undone.'
global: True global: True
advanced: False advanced: False
autoUpdateEnabled:
description: 'Set to true to enable automatic updates of the Sigma Community Ruleset.'
global: True
advanced: True
elastic: elastic:
index: index:
description: Comma-separated list of indices or index patterns (wildcard "*" supported) that SOC will search for records. description: Comma-separated list of indices or index patterns (wildcard "*" supported) that SOC will search for records.
@@ -133,6 +137,11 @@ soc:
description: Duration (in milliseconds) to wait for a response from the Salt API when executing common grid management tasks before giving up and showing an error on the SOC UI. description: Duration (in milliseconds) to wait for a response from the Salt API when executing common grid management tasks before giving up and showing an error on the SOC UI.
global: True global: True
advanced: True advanced: True
strelkaengine:
autoUpdateEnabled:
description: 'Set to true to enable automatic updates of the Yara ruleset.'
global: True
advanced: True
client: client:
enableReverseLookup: enableReverseLookup:
description: Set to true to enable reverse DNS lookups for IP addresses in the SOC UI. description: Set to true to enable reverse DNS lookups for IP addresses in the SOC UI.