From a41c40ccbbe7ae2ad1ebbf9d96485d3f6fafce85 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Thu, 22 Apr 2021 10:53:59 -0400
Subject: [PATCH] Fix Zeek Setting for close-delete

---
 salt/common/tools/sbin/soup | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup
index 8c184e3d1..d6fb62822 100755
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -475,6 +475,34 @@ up_2.3.3X_to_2.3.50_repo() {
 }
 
 up_2.3.3X_to_2.3.50() {
+  
+  cat <<EOF > /tmp/supersed.txt
+/so-zeek:/ {
+  p;
+  n;
+  /shards:/ {
+    p;
+    n;
+    /warm:/ {
+      p;
+      n;
+      /close:/ {
+        s/close: 365/close: 45/;
+        p;
+        n;
+        /delete:/ {
+          s/delete: 45/delete: 365/;
+          p;
+          d;
+        }
+      }
+    }
+  }
+}
+p;
+EOF
+  sed -n -i -f /tmp/supersed.txt /opt/so/saltstack/local/global.sls
+  rm /tmp/supersed.txt
   INSTALLEDVERSION=2.3.50
 }