From 691bef2cf4847cdb9ce3575cfbcd13324c178a24 Mon Sep 17 00:00:00 2001 From: Corey Ogburn Date: Wed, 28 Oct 2026 09:29:48 -0600 Subject: [PATCH] New Configurable Timeouts for Detection Engine Syncs Each engine now has timeouts for how long to allow a sync to go on after detections are modified. --- salt/soc/defaults.yaml | 6 ++++++ salt/soc/soc_soc.yaml | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index 5432536d7..f643ac09c 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1441,6 +1441,8 @@ soc: rulesFingerprintFile: /opt/sensoroni/fingerprints/sigma.fingerprint stateFilePath: /opt/sensoroni/fingerprints/elastalertengine.state integrityCheckFrequencySeconds: 1200 + partialSyncTimeoutSeconds: 300 + bulkSyncTimeoutSeconds: 1800 rulesRepos: default: - repo: https://github.com/Security-Onion-Solutions/securityonion-resources @@ -1700,6 +1702,8 @@ soc: yaraRulesFolder: /opt/sensoroni/yara/rules stateFilePath: /opt/sensoroni/fingerprints/strelkaengine.state integrityCheckFrequencySeconds: 1200 + partialSyncTimeoutSeconds: 300 + bulkSyncTimeoutSeconds: 1800 suricataengine: aiRepoUrl: https://github.com/Security-Onion-Solutions/securityonion-resources aiRepoBranch: generated-summaries-published @@ -1715,6 +1719,8 @@ soc: rulesFingerprintFile: /opt/sensoroni/fingerprints/emerging-all.fingerprint stateFilePath: /opt/sensoroni/fingerprints/suricataengine.state integrityCheckFrequencySeconds: 1200 + partialSyncTimeoutSeconds: 300 + bulkSyncTimeoutSeconds: 1800 ignoredSidRanges: - '1100000-1101000' rulesetSources: diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index 29f98f49f..6255fbd23 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -370,6 +370,18 @@ soc: description: 'How often the ElastAlert integrity checker runs (in seconds). This verifies the integrity of deployed rules.' global: True advanced: True + partialSyncTimeoutSeconds: + description: 'How long to wait for Sigma rules to deploy after a detection is created, updated, or deleted. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: sigma + bulkSyncTimeoutSeconds: + description: 'How long to wait for Sigma rules to deploy after a bulk enable, disable, or delete has saved its detections. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: sigma rulesRepos: default: &eerulesRepos description: "Custom Git repositories to pull Sigma rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections --> Options dropdown menu --> Elastalert --> Full Update." @@ -649,6 +661,18 @@ soc: description: 'How often the Strelka integrity checker runs (in seconds). This verifies the integrity of deployed rules.' global: True advanced: True + partialSyncTimeoutSeconds: + description: 'How long to wait for YARA rules to deploy after a detection is created, updated, or deleted. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: yara + bulkSyncTimeoutSeconds: + description: 'How long to wait for YARA rules to deploy after a bulk enable, disable, or delete has saved its detections. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: yara rulesRepos: default: &serulesRepos description: "Custom Git repositories to pull YARA rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections --> Options dropdown menu --> Strelka --> Full Update." @@ -713,6 +737,18 @@ soc: description: 'How often the Suricata integrity checker runs (in seconds). This verifies the integrity of deployed rules.' global: True advanced: True + partialSyncTimeoutSeconds: + description: 'How long to wait for Suricata rules to deploy after a detection is created, updated, or deleted. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: suricata + bulkSyncTimeoutSeconds: + description: 'How long to wait for Suricata rules to deploy after a bulk enable, disable, or delete has saved its detections. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: suricata customRulesets: description: 'This setting is no longer used. Use Ruleset Sources setting instead.' global: True