IDSTOOLS Pillar Items

salt/idstools/etc/modify.conf

@@ -1,3 +1,4 @@
+{% set modify_sids = salt['pillar.get']('idstools:sids:modify', {}) -%}
 # idstools-rulecat - modify.conf
 
 # Format: <sid> "<from>" "<to>"
@@ -12,3 +13,6 @@
 # For compatibility, most Oinkmaster modifysid lines should work as
 # well.
 #modifysid * "^drop(.*)noalert(.*)" | "alert${1}noalert${2}"
+{%- for sid in modify_sids %}
+{{ sid }}
+{%- endfor %}

salt/idstools/etc/rulecat.conf

@@ -1,6 +1,19 @@
---suricata-version=4.0
+{% set URLS = salt['pillar.get']('idstools:config:urls') -%}
+{% set RULESET = salt['pillar.get']('idstools:config:ruleset') -%}
+{% set OINKCODE = salt['pillar.get']('idstools:config:oinkcode') -%}
+--suricata-version=5.0
 --merged=/opt/so/rules/nids/all.rules
 --local=/opt/so/rules/nids/local.rules
 --disable=/opt/so/idstools/etc/disable.conf
 --enable=/opt/so/idstools/etc/enable.conf
 --modify=/opt/so/idstools/etc/modify.conf
+{%- if RULESET == 'ETOPEN' %}
+--etopen
+{%- elif RULESET == 'ETPRO' %}
+--etpro={{ OINKCODE }}
+{%- elif RULESET == 'TALOS' %}
+--url=https://www.snort.org/rules/snortrules-snapshot-2983.tar.gz?oinkcode={{ OINKCODE }}
+{%- endif %}
+{%- for URL in URLS %}
+--url={{ URL }}
+{%- endfor %}