CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

IDSTOOLS Pillar Items

Browse Source
This commit is contained in:
Mike Reeves
2020-07-17 15:59:58 -04:00
parent d3529686cc
commit 693a101d34
4 changed files with 31 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/idstools/etc/modify.conf
View File

@@ -1,3 +1,4 @@
{% set modify_sids = salt['pillar.get']('idstools:sids:modify', {}) -%}
# idstools-rulecat - modify.conf
# Format: <sid> "<from>" "<to>"
@@ -12,3 +13,6 @@
# For compatibility, most Oinkmaster modifysid lines should work as
# well.
#modifysid * "^drop(.*)noalert(.*)" | "alert${1}noalert${2}"
{%- for sid in modify_sids %}
{{ sid }}
{%- endfor %}

15
salt/idstools/etc/rulecat.conf
View File

@@ -1,6 +1,19 @@
--suricata-version=4.0
{% set URLS = salt['pillar.get']('idstools:config:urls') -%}
{% set RULESET = salt['pillar.get']('idstools:config:ruleset') -%}
{% set OINKCODE = salt['pillar.get']('idstools:config:oinkcode') -%}
--suricata-version=5.0
--merged=/opt/so/rules/nids/all.rules
--local=/opt/so/rules/nids/local.rules
--disable=/opt/so/idstools/etc/disable.conf
--enable=/opt/so/idstools/etc/enable.conf
--modify=/opt/so/idstools/etc/modify.conf
{%- if RULESET == 'ETOPEN' %}
--etopen
{%- elif RULESET == 'ETPRO' %}
--etpro={{ OINKCODE }}
{%- elif RULESET == 'TALOS' %}
--url=https://www.snort.org/rules/snortrules-snapshot-2983.tar.gz?oinkcode={{ OINKCODE }}
{%- endif %}
{%- for URL in URLS %}
--url={{ URL }}
{%- endfor %}

11
setup/so-functions
View File

@@ -982,8 +982,19 @@ manager_pillar() {
"pcap:">> "$pillar_file"\
" sensor_checkin_interval_ms: $SENSOR_CHECKIN_INTERVAL_MS"\
""\
"idstools:"\
" config:"\
" ruleset: $RULESETUP"\
" oinkcode: $OINKCODE"\
" url:"\
" sids:"\
" enabled:"\
" disabled:"\
" modify:"\
""
"kratos:" >> "$pillar_file"
printf '%s\n'\
" kratoskey: $KRATOSKEY"\
"" >> "$pillar_file"

5
setup/so-whiptail
View File

@@ -576,7 +576,7 @@ whiptail_oinkcode() {
[ -n "$TESTING" ] && return
OINKCODE=$(whiptail --title "Security Onion Setup" --inputbox \
"Enter your oinkcode" 10 75 XXXXXXX 3>&1 1>&2 2>&3)
"Enter your ET Pro or oinkcode" 10 75 XXXXXXX 3>&1 1>&2 2>&3)
local exitstatus=$?
whiptail_check_exitstatus $exitstatus
@@ -956,8 +956,7 @@ whiptail_rule_setup() {
"Which IDS ruleset would you like to use?\n\nThis manager server is responsible for downloading the IDS ruleset from the Internet.\n\nSensors then pull a copy of this ruleset from the manager server.\n\nIf you select a commercial ruleset, it is your responsibility to purchase enough licenses for all of your sensors in compliance with your vendor's policies." 20 75 4 \
"ETOPEN" "Emerging Threats Open" ON \
"ETPRO" "Emerging Threats PRO" OFF \
"TALOSET" "Snort Subscriber (Talos) and ET NoGPL rulesets" OFF \
"TALOS" "Snort Subscriber (Talos) ruleset and set a policy" OFF \
"TALOS" "Snort Subscriber ruleset - Experimental" OFF \
3>&1 1>&2 2>&3)
local exitstatus=$?