Merge pull request #8966 from Security-Onion-Solutions/curator2.4

Curator2.4

salt/curator/defaults.yaml

@@ -88,6 +88,10 @@ elasticsearch:
       warm: 7
       close: 30
       delete: 365
+    so-kratos:
+      warm: 7
+      close: 30
+      delete: 365
     so-kibana:
       warm: 7
       close: 30
@@ -124,6 +128,10 @@ elasticsearch:
       warm: 7
       close: 30
       delete: 365
+    so-ossec:
+      warm: 7
+      close: 30
+      delete: 365
     so-proofpoint:
       warm: 7
       close: 30
@@ -171,4 +179,4 @@ elasticsearch:
     so-zscaler:
       warm: 7
       close: 30
-      delete: 365
+      delete: 365

salt/curator/files/action/so-aws-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-aws:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-aws'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-aws-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-aws:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-aws'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-aws-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-aws:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-aws'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-azure-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-azure:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-azure'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-azure-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-azure:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-azure'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-azure-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-azure:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-azure'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-barracuda-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-barracuda:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-barracuda'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-barracuda-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-barracuda:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-barracuda'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-barracuda-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-barracuda:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-barracuda'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-beats-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-beats:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-beats'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-beats-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-beats:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-beats'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-beats-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-beats:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-beats'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-bluecoat-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-bluecoat:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-bluecoat'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-bluecoat-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-bluecoat:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-bluecoat'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-bluecoat-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-bluecoat:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-bluecoat'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-cef-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-cef:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-cef'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-cef-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cef:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-cef'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-cef-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cef:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-cef'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-checkpoint-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-checkpoint:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-checkpoint'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-checkpoint-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-checkpoint:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-checkpoint'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-checkpoint-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-checkpoint:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-checkpoint'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-cisco-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-cisco:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-cisco'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-cisco-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cisco:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-cisco'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-cisco-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cisco:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-cisco'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-cyberark-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-cyberark:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-cyberark'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-cyberark-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cyberark:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-cyberark'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-cyberark-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cyberark:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-cyberark'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-cylance-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-cylance:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-cylance'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-cylance-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cylance:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-cylance'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-cylance-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cylance:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-cylance'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-elasticsearch-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-elasticsearch:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-elasticsearch'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-elasticsearch-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-elasticsearch:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-elasticsearch'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-elasticsearch-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-elasticsearch:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-elasticsearch'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-endgame-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-endgame:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-endgame'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-endgame-delete.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-endgame:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-endgame'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-endgame-warm.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-endgame:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-endgame'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-f5-close.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-f5:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-f5'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-f5-delete.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-f5:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-f5'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-f5-warm.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-f5:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-f5'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-firewall-close.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-firewall:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-firewall'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-firewall-delete.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-firewall:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-firewall'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-firewall-warm.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-firewall:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-firewall'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-fortinet-close.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-fortinet:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-fortinet'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-fortinet-delete.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-fortinet:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-fortinet'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-fortinet-warm.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-fortinet:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-fortinet'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-gcp-close.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-gcp:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-gcp'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-gcp-delete.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-gcp:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-gcp'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-gcp-warm.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-gcp:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-gcp'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-google_workspace-close.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-google_workspace:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-google_workspace'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-google_workspace-delete.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-google_workspace:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-google_workspace'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-google_workspace-warm.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-google_workspace:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-google_workspace'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-ids-close.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-ids:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-ids'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-ids-delete.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-ids:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-ids'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-ids-warm.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-ids:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-ids'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-imperva-close.yml

@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-imperva:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-imperva'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-imperva-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-imperva:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-imperva'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-imperva-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-imperva:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-imperva'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-import-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-import:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-import'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-import-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-import:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-import'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-import-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-import:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-import'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-infoblox-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-infoblox:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-infoblox'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-infoblox-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-infoblox:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-infoblox'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-infoblox-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-infoblox:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-infoblox'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-juniper-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-juniper:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-juniper'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-juniper-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-juniper:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-juniper'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-juniper-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-aws:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-aws'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-kibana-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-kibana:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-kibana'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-kibana-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-kibana:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-kibana'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-kibana-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-kibana:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-kibana'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-kratos-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-kratos:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-kratos'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-kratos-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-kratos:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-kratos'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-kratos-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-kratos:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-kratos'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-logstash-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-logstash:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-logstash'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-logstash-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-logstash:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-logstash'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-logstash-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-logstash:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-logstash'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-microsoft-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-microsoft:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-microsoft'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-microsoft-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-microsoft:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-microsoft'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-microsoft-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-microsoft:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-microsoft'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-misp-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-misp:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-misp'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-misp-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-misp:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-misp'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-misp-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-misp:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-misp'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-netflow-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-netflow:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-netflow'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-netflow-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-netflow:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-netflow'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-netflow-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-netflow:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-netflow'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-netscout-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-netscout:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-netscout'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-netscout-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-netscout:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-netscout'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-netscout-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-netscout:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-netscout'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-o365-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-o365:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-o365'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-o365-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-o365:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-o365'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-o365-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-o365:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-o365'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-okta-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-okta:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-okta'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-okta-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-okta:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-okta'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-okta.delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-okta:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-okta'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-osquery-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-osquery:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-osquery'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-osquery-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-osquery:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-osquery'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-osquery-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-osquery:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-osquery'].warm -%}
 actions:
   1:
     action: allocation

salt/curator/files/action/so-ossec-close.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-ossec:close') -%}
+{%- set cur_close_days = CURATORMERGED['so-ossec'].close -%}
 actions:
   1:
     action: close

salt/curator/files/action/so-ossec-delete.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-ossec:delete') -%}
+{%- set DELETE_DAYS = CURATORMERGED['so-ossec'].delete -%}
 actions:
   1:
     action: delete_indices

salt/curator/files/action/so-ossec-warm.yml

@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-ossec:warm') -%}
+{%- set WARM_DAYS = CURATORMERGED['so-ossec'].warm -%}
 actions:
   1:
     action: allocation