From 89eb2d0a8b0e49f61bddb3fcf109c9b2e58a014c Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Wed, 16 Feb 2022 14:24:58 -0500
Subject: [PATCH] Add netowrks.cfg to Zeek

---
 salt/zeek/files/networks.cfg |  6 ++++++
 salt/zeek/init.sls           | 10 ++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 salt/zeek/files/networks.cfg

diff --git a/salt/zeek/files/networks.cfg b/salt/zeek/files/networks.cfg
new file mode 100644
index 000000000..b11ce7c4c
--- /dev/null
+++ b/salt/zeek/files/networks.cfg
@@ -0,0 +1,6 @@
+{%- if salt['pillar.get']('sensor:hnsensor') %}
+{%- set HOME_NET = salt['pillar.get']('sensor:hnsensor') %}
+{%- else %}
+{%- set HOME_NET = salt['pillar.get']('global:hnmanager') %}"
+{%- endif %}
+{{ HOME_NET }}
\ No newline at end of file
diff --git a/salt/zeek/init.sls b/salt/zeek/init.sls
index 277a523a8..85c665c2a 100644
--- a/salt/zeek/init.sls
+++ b/salt/zeek/init.sls
@@ -127,6 +127,14 @@ nodecfg:
     - group: 939
     - template: jinja
 
+networkscfg:
+  file.managed:
+    - name: /opt/so/conf/zeek/netowrks.cfg
+    - source: salt://zeek/files/networks.cfg
+    - user: 937
+    - group: 939
+    - template: jinja
+
 #zeekcleanscript:
 #  file.managed:
 #    - name: /usr/local/bin/zeek_clean
@@ -209,6 +217,7 @@ so-zeek:
       - /nsm/zeek/extracted:/nsm/zeek/extracted:rw
       - /opt/so/conf/zeek/local.zeek:/opt/zeek/share/zeek/site/local.zeek:ro
       - /opt/so/conf/zeek/node.cfg:/opt/zeek/etc/node.cfg:ro
+      - /opt/so/conf/zeek/networks.cfg:/opt/zeek/etc/networks.cfg:ro
       - /opt/so/conf/zeek/zeekctl.cfg:/opt/zeek/etc/zeekctl.cfg:ro
       - /opt/so/conf/zeek/policy/securityonion:/opt/zeek/share/zeek/policy/securityonion:ro
       - /opt/so/conf/zeek/policy/custom:/opt/zeek/share/zeek/policy/custom:ro
@@ -219,6 +228,7 @@ so-zeek:
     - watch:
       - file: /opt/so/conf/zeek/local.zeek
       - file: /opt/so/conf/zeek/node.cfg
+      - file: /opt/so/conf/zeek/networks.cfg
       - file: /opt/so/conf/zeek/zeekctl.cfg
       - file: /opt/so/conf/zeek/policy
       - file: /opt/so/conf/zeek/bpf