From a0388fd56828e613c7c72c639093586d080239b5 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 29 Apr 2024 14:02:10 -0400
Subject: [PATCH] engines config for valueWatch

---
 salt/salt/files/engines.conf | 43 ++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/salt/salt/files/engines.conf b/salt/salt/files/engines.conf
index 483f9c08b..21efbcc6d 100644
--- a/salt/salt/files/engines.conf
+++ b/salt/salt/files/engines.conf
@@ -4,6 +4,49 @@ engines_dirs:
 engines:
   - checkmine:
       interval: 60
+  - valueWatch:
+      watched:
+        - value: GLOBALMERGED.pipeline
+          files:
+            - /opt/so/saltstack/local/pillar/global/soc_global.sls
+            - /opt/so/saltstack/local/pillar/global/adv_global.sls
+          map: global/map.jinja
+          targets:
+            - so-manager
+            - so-managersearch
+          ttype: compound
+          actions:
+            from:
+              '*':
+                to:
+                  KAFKA:
+                  - cmd.run:
+                      cmd: /usr/sbin/so-yaml.py replace /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls kafka.enabled True
+              KAFKA:
+                to:
+                  '*':
+                  - cmd.run:
+                      cmd: /usr/sbin/so-yaml.py replace /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls kafka.enabled False
+
+        - value: FIREWALL_MERGED
+          files:
+            - /opt/so/saltstack/local/pillar/firewall/soc_firewall.sls
+            - /opt/so/saltstack/local/pillar/firewall/adv_firewall.sls
+            - /opt/so/saltstack/local/pillar/minions/*.sls
+          map: firewall/map.jinja
+          targets:
+            - so-*
+          ttype: compound
+          actions:
+            from:
+              '*':
+                to:
+                  '*':
+                  - cmd.run:
+                      cmd: date
+      interval: 10
+
+
   - pillarWatch:
       fpa:
         # these files will be checked in reversed order to replicate the same hierarchy as the pillar top file