Merge pull request #1273 from Security-Onion-Solutions/fix/zeek_syslog_default

Fix/zeek syslog default

setup/so-functions

@@ -1980,7 +1980,7 @@ zeek_logs_enabled() {
 		for BLOG in "${BLOGS[@]}"; do
 			echo "    - $BLOG" | tr -d '"' >> "$zeeklogs_pillar"
 		done
-	else
+	elif [ "$install_type" == "EVAL" ]; then
 		printf '%s\n'\
                         "    - conn"\
                         "    - dce_rpc"\
@@ -2020,6 +2020,46 @@ zeek_logs_enabled() {
                         "    - mysql"\
                         "    - socks"\
                         "    - x509" >> "$zeeklogs_pillar"
+	# Disable syslog log by default
+	else
+		printf '%s\n'\
+			"    - conn"\
+			"    - dce_rpc"\
+			"    - dhcp"\
+			"    - dhcpv6"\
+			"    - dnp3"\
+			"    - dns"\
+			"    - dpd"\
+			"    - files"\
+			"    - ftp"\
+			"    - http"\
+			"    - intel"\
+			"    - irc"\
+			"    - kerberos"\
+			"    - modbus"\
+			"    - mqtt"\
+			"    - notice"\
+			"    - ntlm"\
+			"    - openvpn"\
+			"    - pe"\
+			"    - radius"\
+			"    - rfb"\
+			"    - rdp"\
+			"    - signatures"\
+			"    - sip"\
+			"    - smb_files"\
+			"    - smb_mapping"\
+			"    - smtp"\
+			"    - snmp"\
+			"    - software"\
+			"    - ssh"\
+			"    - ssl"\
+			"    - telnet"\
+			"    - tunnel"\
+			"    - weird"\
+			"    - mysql"\
+			"    - socks"\
+			"    - x509" >> "$zeeklogs_pillar"
 	fi
 
 	printf '%s\n'  '----' >> "$setup_log" 2>&1