CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-19 07:23:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

move to custom rules

Browse Source
This commit is contained in:
DefensiveDepth
2024-06-14 12:41:44 -04:00
parent 4bcb4b5b9c
commit 8363877c66
3 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/idstools/config.sls
View File

@@ -42,7 +42,7 @@ suricatacustomdirsfile:
suricatacustomdirsurl: suricatacustomdirsurl:
file.directory: file.directory:
- name: /nsm/rules/detect-suricata/custom_urls - name: /nsm/rules/detect-suricata/custom_temp
- user: 939 - user: 939
- group: 939 - group: 939

3
salt/idstools/etc/rulecat.conf
View File

@@ -1,7 +1,8 @@
{%- from 'vars/globals.map.jinja' import GLOBALS -%} {%- from 'vars/globals.map.jinja' import GLOBALS -%}
{%- from 'soc/merged.map.jinja' import SOCMERGED -%} {%- from 'soc/merged.map.jinja' import SOCMERGED -%}
--temp-dir=/nsm/rules/detect-suricata/custom_urls --suricata-version=6.0
--merged=/opt/so/rules/nids/suri/all.rules --merged=/opt/so/rules/nids/suri/all.rules
--output=/nsm/rules/detect-suricata/custom_temp
--local=/opt/so/rules/nids/suri/local.rules --local=/opt/so/rules/nids/suri/local.rules
{%- if GLOBALS.md_engine == "SURICATA" %} {%- if GLOBALS.md_engine == "SURICATA" %}
--local=/opt/so/rules/nids/suri/extraction.rules --local=/opt/so/rules/nids/suri/extraction.rules

2
salt/idstools/tools/sbin_jinja/so-rule-update
View File

@@ -26,8 +26,6 @@ if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
docker exec so-idstools idstools-rulecat -v --suricata-version 6.0 -o /nsm/rules/suricata/ --merged=/nsm/rules/suricata/emerging-all.rules --force docker exec so-idstools idstools-rulecat -v --suricata-version 6.0 -o /nsm/rules/suricata/ --merged=/nsm/rules/suricata/emerging-all.rules --force
{%- elif IDSTOOLSMERGED.config.ruleset == 'ETPRO' %} {%- elif IDSTOOLSMERGED.config.ruleset == 'ETPRO' %}
docker exec so-idstools idstools-rulecat -v --suricata-version 6.0 -o /nsm/rules/suricata/ --merged=/nsm/rules/suricata/emerging-all.rules --force --etpro={{ IDSTOOLSMERGED.config.oinkcode }} docker exec so-idstools idstools-rulecat -v --suricata-version 6.0 -o /nsm/rules/suricata/ --merged=/nsm/rules/suricata/emerging-all.rules --force --etpro={{ IDSTOOLSMERGED.config.oinkcode }}
{%- elif IDSTOOLSMERGED.config.ruleset == 'TALOS' %}
docker exec so-idstools idstools-rulecat -v --suricata-version 6.0 -o /nsm/rules/suricata/ --merged=/nsm/rules/suricata/emerging-all.rules --force --url=https://www.snort.org/rules/snortrules-snapshot-2983.tar.gz?oinkcode={{ IDSTOOLSMERGED.config.oinkcode }}
{%- endif %} {%- endif %}
{%- endif %} {%- endif %}