IDSTOOLS Pillar Items

salt/idstools/etc/modify.conf

@@ -1,3 +1,4 @@
+{% set modify_sids = salt['pillar.get']('idstools:sids:modify', {}) -%}
 # idstools-rulecat - modify.conf
 
 # Format: <sid> "<from>" "<to>"
@@ -12,3 +13,6 @@
 # For compatibility, most Oinkmaster modifysid lines should work as
 # well.
 #modifysid * "^drop(.*)noalert(.*)" | "alert${1}noalert${2}"
+{%- for sid in modify_sids %}
+{{ sid }}
+{%- endfor %}