CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-03-26 06:22:39 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix pcap migration to strip yaml document end marker from so-yaml output

Browse Source
This commit is contained in:
Mike Reeves
2026-03-13 15:09:37 -04:00
parent 18f971954b
commit 81c1d8362d
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/manager/tools/sbin/soup
View File

@@ -396,7 +396,7 @@ migrate_pcap_to_suricata() {
for pillar_file in "$PCAPFILE" "$MINIONDIR"/*.sls; do
[[ -f "$pillar_file" ]] || continue
pcap_enabled=$(so-yaml.py get "$pillar_file" pcap.enabled 2>/dev/null) || continue
pcap_enabled=$(so-yaml.py get "$pillar_file" pcap.enabled 2>/dev/null | head -1) || continue
so-yaml.py add "$pillar_file" suricata.pcap.enabled "$pcap_enabled"
so-yaml.py remove "$pillar_file" pcap
done