CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

add classification.config

Browse Source
This commit is contained in:
m0duspwnens
2024-02-26 11:01:53 -05:00
parent d2f7946377
commit 9a7e2153ee
4 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/suricata/classification/classification.config Normal file
View File

@@ -0,0 +1,2 @@
# configuration classification: shortname,description,priority
# configuration classification: misc-activity,Misc activity,3

7
salt/suricata/config.sls
View File

@@ -129,6 +129,13 @@ surithresholding:
- group: 940 - group: 940
- template: jinja - template: jinja
suriclassifications:
file.managed:
- name: /opt/so/conf/suricata/classification.config
- source: salt://suricata/classification/classification.config
- user: 940
- group: 940
# BPF compilation and configuration # BPF compilation and configuration
{% if SURICATABPF %} {% if SURICATABPF %}
{% set BPF_CALC = salt['cmd.script']('salt://common/tools/sbin/so-bpf-compile', GLOBALS.sensor.interface + ' ' + SURICATABPF|join(" "),cwd='/root') %} {% set BPF_CALC = salt['cmd.script']('salt://common/tools/sbin/so-bpf-compile', GLOBALS.sensor.interface + ' ' + SURICATABPF|join(" "),cwd='/root') %}

1
salt/suricata/enabled.sls
View File

@@ -27,6 +27,7 @@ so-suricata:
- binds: - binds:
- /opt/so/conf/suricata/suricata.yaml:/etc/suricata/suricata.yaml:ro - /opt/so/conf/suricata/suricata.yaml:/etc/suricata/suricata.yaml:ro
- /opt/so/conf/suricata/threshold.conf:/etc/suricata/threshold.conf:ro - /opt/so/conf/suricata/threshold.conf:/etc/suricata/threshold.conf:ro
- /opt/so/conf/suricata/classification.config:/etc/suricata/classification.config:ro
- /opt/so/conf/suricata/rules:/etc/suricata/rules:ro - /opt/so/conf/suricata/rules:/etc/suricata/rules:ro
- /opt/so/log/suricata/:/var/log/suricata/:rw - /opt/so/log/suricata/:/var/log/suricata/:rw
- /nsm/suricata/:/nsm/:rw - /nsm/suricata/:/nsm/:rw

7
salt/suricata/soc_suricata.yaml
View File

@@ -11,6 +11,13 @@ suricata:
multiline: True multiline: True
title: SIDS title: SIDS
helpLink: suricata.html helpLink: suricata.html
classification:
classification__config:
description: Classifications config file.
file: True
global: True
multiline: True
helpLink: suricata.html
config: config:
af-packet: af-packet:
interface: interface: