New Configurable Timeouts for Detection Engine Syncs

Each engine now has timeouts for how long to allow a sync to go on after detections are modified.

salt/soc/defaults.yaml

@@ -1441,6 +1441,8 @@ soc:
           rulesFingerprintFile: /opt/sensoroni/fingerprints/sigma.fingerprint
           stateFilePath: /opt/sensoroni/fingerprints/elastalertengine.state
           integrityCheckFrequencySeconds: 1200
+          partialSyncTimeoutSeconds: 300
+          bulkSyncTimeoutSeconds: 1800
           rulesRepos:
             default:
               - repo: https://github.com/Security-Onion-Solutions/securityonion-resources
@@ -1700,6 +1702,8 @@ soc:
           yaraRulesFolder: /opt/sensoroni/yara/rules
           stateFilePath: /opt/sensoroni/fingerprints/strelkaengine.state
           integrityCheckFrequencySeconds: 1200
+          partialSyncTimeoutSeconds: 300
+          bulkSyncTimeoutSeconds: 1800
         suricataengine:
           aiRepoUrl: https://github.com/Security-Onion-Solutions/securityonion-resources
           aiRepoBranch: generated-summaries-published
@@ -1715,6 +1719,8 @@ soc:
           rulesFingerprintFile: /opt/sensoroni/fingerprints/emerging-all.fingerprint
           stateFilePath: /opt/sensoroni/fingerprints/suricataengine.state
           integrityCheckFrequencySeconds: 1200
+          partialSyncTimeoutSeconds: 300
+          bulkSyncTimeoutSeconds: 1800
           ignoredSidRanges:
             - '1100000-1101000'
           rulesetSources:

salt/soc/soc_soc.yaml

@@ -370,6 +370,18 @@ soc:
             description: 'How often the ElastAlert integrity checker runs (in seconds). This verifies the integrity of deployed rules.'
             global: True
             advanced: True
+          partialSyncTimeoutSeconds:
+            description: 'How long to wait for Sigma rules to deploy after a detection is created, updated, or deleted. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.'
+            global: True
+            advanced: True
+            forcedType: int
+            helpLink: sigma
+          bulkSyncTimeoutSeconds:
+            description: 'How long to wait for Sigma rules to deploy after a bulk enable, disable, or delete has saved its detections. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.'
+            global: True
+            advanced: True
+            forcedType: int
+            helpLink: sigma
           rulesRepos:
             default: &eerulesRepos
               description: "Custom Git repositories to pull Sigma rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections -->  Options dropdown menu --> Elastalert --> Full Update."
@@ -649,6 +661,18 @@ soc:
             description: 'How often the Strelka integrity checker runs (in seconds). This verifies the integrity of deployed rules.'
             global: True
             advanced: True
+          partialSyncTimeoutSeconds:
+            description: 'How long to wait for YARA rules to deploy after a detection is created, updated, or deleted. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.'
+            global: True
+            advanced: True
+            forcedType: int
+            helpLink: yara
+          bulkSyncTimeoutSeconds:
+            description: 'How long to wait for YARA rules to deploy after a bulk enable, disable, or delete has saved its detections. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.'
+            global: True
+            advanced: True
+            forcedType: int
+            helpLink: yara
           rulesRepos:
             default: &serulesRepos
               description: "Custom Git repositories to pull YARA rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections -->  Options dropdown menu --> Strelka --> Full Update."
@@ -713,6 +737,18 @@ soc:
             description: 'How often the Suricata integrity checker runs (in seconds). This verifies the integrity of deployed rules.'
             global: True
             advanced: True
+          partialSyncTimeoutSeconds:
+            description: 'How long to wait for Suricata rules to deploy after a detection is created, updated, or deleted. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.'
+            global: True
+            advanced: True
+            forcedType: int
+            helpLink: suricata
+          bulkSyncTimeoutSeconds:
+            description: 'How long to wait for Suricata rules to deploy after a bulk enable, disable, or delete has saved its detections. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.'
+            global: True
+            advanced: True
+            forcedType: int
+            helpLink: suricata
           customRulesets:
             description: 'This setting is no longer used. Use Ruleset Sources setting instead.'
             global: True