CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add context

Browse Source
This commit is contained in:
DefensiveDepth
2025-11-29 15:17:28 -05:00
parent 1284150382
commit 89a9106d79
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
salt/manager/tools/sbin/soup
View File

@@ -1234,11 +1234,12 @@ check_config_file() {
echo "Does not match known default - custom configuration detected" echo "Does not match known default - custom configuration detected"
echo "Custom $file_display_name detected (hash: $file_hash)" >> /opt/so/conf/soc/fingerprints/suricataengine.syncBlock echo "Custom $file_display_name detected (hash: $file_hash)" >> /opt/so/conf/soc/fingerprints/suricataengine.syncBlock
# If this is so-rule-update, check for ETPRO key # If this is so-rule-update, check for ETPRO license code and write out to the syncBlock file
# If ETPRO is enabled, the license code already exists in the so-rule-update script, this is just making it easier to migrate
if [[ "$file_display_name" == "so-rule-update" ]]; then if [[ "$file_display_name" == "so-rule-update" ]]; then
etpro_key=$(grep -oP '\-\-etpro=\K[0-9a-fA-F]+' "$file" 2>/dev/null || true) etpro_code=$(grep -oP '\-\-etpro=\K[0-9a-fA-F]+' "$file" 2>/dev/null || true)
if [[ -n "$etpro_key" ]]; then if [[ -n "$etpro_code" ]]; then
echo "ETPRO key found: $etpro_key" >> /opt/so/conf/soc/fingerprints/suricataengine.syncBlock echo "ETPRO code found: $etpro_code" >> /opt/so/conf/soc/fingerprints/suricataengine.syncBlock
fi fi
fi fi

1
salt/soc/merged.map.jinja
View File

@@ -108,6 +108,7 @@
{% if ruleset.name == 'Emerging-Threats' %} {% if ruleset.name == 'Emerging-Threats' %}
{% if ruleset.licenseKey and ruleset.licenseKey != '' %} {% if ruleset.licenseKey and ruleset.licenseKey != '' %}
{# License key is defined - transform to ETPRO #} {# License key is defined - transform to ETPRO #}
{# Engine Version is hardcoded in the URL - this does not change often: https://community.emergingthreats.net/t/supported-engines/71 #}
{% do ruleset.update({ {% do ruleset.update({
'name': 'ETPRO', 'name': 'ETPRO',
'sourcePath': 'https://rules.emergingthreatspro.com/' ~ ruleset.licenseKey ~ '/suricata-7.0.3/etpro.rules.tar.gz', 'sourcePath': 'https://rules.emergingthreatspro.com/' ~ ruleset.licenseKey ~ '/suricata-7.0.3/etpro.rules.tar.gz',