mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-01-11 10:43:28 +01:00
change how we populate local.zeek - https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/585
This commit is contained in:
@@ -16,7 +16,7 @@ zeek:
|
||||
CfgDir: /opt/zeek/etc
|
||||
CompressLogs: 1
|
||||
local:
|
||||
load:
|
||||
'@load':
|
||||
- misc/loaded-scripts
|
||||
- tuning/defaults
|
||||
- misc/capture-loss
|
||||
@@ -48,7 +48,7 @@ zeek:
|
||||
- securityonion/bpfconf
|
||||
- securityonion/communityid
|
||||
- securityonion/file-extraction
|
||||
load-sigs:
|
||||
'@load-sigs':
|
||||
- frameworks/signatures/detect-windows-shells
|
||||
redef:
|
||||
- LogAscii::use_json = T;
|
||||
|
||||
Reference in New Issue
Block a user