From 8ce0d7628767f5635930c6875327573473ef9c85 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Thu, 25 May 2023 12:12:18 -0400
Subject: [PATCH] Zeek Annotations

---
 salt/zeek/soc_zeek.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/salt/zeek/soc_zeek.yaml b/salt/zeek/soc_zeek.yaml
index 8410d4e75..fabd7c209 100644
--- a/salt/zeek/soc_zeek.yaml
+++ b/salt/zeek/soc_zeek.yaml
@@ -21,6 +21,15 @@ zeek:
         forcedType: "[]string"
         advanced: True
         helpLink: zeek.html
+    networks:
+      HOME_NET:
+        description: List of IP or CIDR blocks to define as the HOME_NET.
+        forcedType: "[]string"
+        advanced: False
+        helpLink: zeek.html
+        multiline: True
+        regex: ^(([0-9]{1,3}\.){3}[0-9]{1,3}(\/([0-9]|[1-2][0-9]|3[0-2]))?)?$
+        regexFailureMessage: You must enter a valid IP address or CIDR.
     node:
       lb_procs:
         description: Contains the number of CPU cores or workers used by Zeek. This setting should only be applied to individual nodes and will be ignored if CPU affinity is enabled.