CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add annotation logic

Browse Source
This commit is contained in:
Mike Reeves
2024-01-29 15:27:28 -05:00
parent 0c969312e2
commit 88c01a22d6
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
salt/suricata/soc_suricata.yaml
View File

@@ -44,6 +44,7 @@ suricata:
set-cpu-affinity: set-cpu-affinity:
description: Bind(yes) or unbind(no) management and worker threads to a core or range of cores. description: Bind(yes) or unbind(no) management and worker threads to a core or range of cores.
regex: ^(yes|no)$ regex: ^(yes|no)$
regexFailureMessage: You must enter either yes or no.
helpLink: suricata.html helpLink: suricata.html
cpu-affinity: cpu-affinity:
management-cpu-set: management-cpu-set:
@@ -155,7 +156,7 @@ suricata:
helpLink: suricata.html helpLink: suricata.html
pcap-log: pcap-log:
enabled: enabled:
description: This value is ignored by SO. pcapengine in globals takes predidence. description: This value is ignored by SO. pcapengine in globals takes precidence.
readonly: True readonly: True
helpLink: suricata.html helpLink: suricata.html
advanced: True advanced: True
@@ -193,9 +194,13 @@ suricata:
use-stream-depth: use-stream-depth:
description: Set to "no" to ignore the stream depth and capture the entire flow. Set this to "yes" to truncate the flow based on the stream depth. description: Set to "no" to ignore the stream depth and capture the entire flow. Set this to "yes" to truncate the flow based on the stream depth.
advanced: True advanced: True
regex: ^(yes|no)$
regexFailureMessage: You must enter either yes or no.
helpLink: suricata.html helpLink: suricata.html
conditional: conditional:
description: Set to "all" to capture PCAP for all flows. Set to "alert" to capture PCAP just for alerts or set to "tag" to capture PCAP for just tagged rules. description: Set to "all" to capture PCAP for all flows. Set to "alert" to capture PCAP just for alerts or set to "tag" to capture PCAP for just tagged rules.
regex: ^(all|alert|tag)$
regexFailureMessage: You must enter either all, alert or tag.
helpLink: suricata.html helpLink: suricata.html
dir: dir:
description: Parent directory to store PCAP. description: Parent directory to store PCAP.