CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 09:42:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

add to defaults and tweaks

Browse Source
This commit is contained in:
DefensiveDepth
2024-06-14 09:28:23 -04:00
parent c1abc7a7f1
commit 68302e14b9
3 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
salt/idstools/config.sls
View File

@@ -45,7 +45,6 @@ suricatacustomdirsurl:
- name: /nsm/rules/detect-suricata/custom_urls - name: /nsm/rules/detect-suricata/custom_urls
- user: 939 - user: 939
- group: 939 - group: 939
- makedirs: True
{% else %} {% else %}

1
salt/soc/defaults.yaml
View File

@@ -1399,6 +1399,7 @@ soc:
autoUpdateEnabled: true autoUpdateEnabled: true
communityRulesImportFrequencySeconds: 86400 communityRulesImportFrequencySeconds: 86400
communityRulesImportErrorSeconds: 300 communityRulesImportErrorSeconds: 300
customRulesets: ''
failAfterConsecutiveErrorCount: 10 failAfterConsecutiveErrorCount: 10
communityRulesFile: /nsm/rules/suricata/emerging-all.rules communityRulesFile: /nsm/rules/suricata/emerging-all.rules
denyRegex: '' denyRegex: ''

2
salt/soc/soc_soc.yaml
View File

@@ -248,7 +248,7 @@ soc:
global: True global: True
advanced: True advanced: True
customRulesets: customRulesets:
description: 'Custom URLs or local files to sync Suricata rules from. Format is: {"community":true,"license":"GPLv2","ruleset":"snort-community","url":"https://www.snort.org/downloads/community/snort3-community-rules.tar.gz"}. All fields are required. Replace the url parameter with "file" and the path for local rules, which must be put under: /nsm/rules/detect-suricata/custom_file. "community" disables some management options for the imported rules - they can''t be deleted or edited, just tuned, duplicated, and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by navigating to Detections --> Options dropdown menu --> Suricata --> Full Update.' description: 'URLs and/or Local File configurations for Suricata custom rulesets. Refer to the linked documentation for important specification and file placement information'
global: True global: True
multiline: True multiline: True
advanced: True advanced: True