CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-13 04:32:48 +01:00
Code Issues Packages Projects Releases Wiki Activity

pcap improvements

Browse Source
This commit is contained in:
Jason Ertel
2024-03-08 15:48:53 -05:00
parent 40574982e4
commit a55e04e64a
7 changed files with 19 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
salt/sensoroni/enabled.sls
View File

@@ -23,10 +23,7 @@ so-sensoroni:
- /opt/so/conf/sensoroni/sensoroni.json:/opt/sensoroni/sensoroni.json:ro
- /opt/so/conf/sensoroni/analyzers:/opt/sensoroni/analyzers:rw
- /opt/so/log/sensoroni:/opt/sensoroni/logs:rw
{% if GLOBALS.pcap_engine == "SURICATA" %}
- /nsm/suripcap/:/nsm/suripcap:rw
- /nsm/suripcaptmp:/nsm/suripcaptmp:rw
{% endif %}
{% if DOCKER.containers['so-sensoroni'].custom_bind_mounts %}
{% for BIND in DOCKER.containers['so-sensoroni'].custom_bind_mounts %}
- {{ BIND }}

12
salt/sensoroni/files/sensoroni.json
View File

@@ -23,29 +23,19 @@
"statickeyauth": {
"apiKey": "{{ GLOBALS.sensoroni_key }}"
{% if GLOBALS.is_sensor %}
{% from 'pcap/config.map.jinja' import PCAPMERGED %}
{% from 'suricata/map.jinja' import SURICATAMERGED %}
{# if PCAPMERGED.enabled is true then we know that steno is the pcap engine #}
{# if it is false, then user has steno disabled in ui or has selected suricata for pcap engine #}
{%- if PCAPMERGED.enabled %}
},
"stenoquery": {
"executablePath": "/opt/sensoroni/scripts/stenoquery.sh",
"pcapInputPath": "/nsm/pcap",
"pcapOutputPath": "/nsm/pcapout"
}
{%- elif GLOBALS.pcap_engine == "SURICATA" and SURICATAMERGED.enabled %}
},
"suriquery": {
"executablePath": "/opt/sensoroni/scripts/suriquery.sh",
"pcapInputPath": "/nsm/suripcap",
"pcapOutputPath": "/nsm/pcapout",
"pcapMaxCount": {{ SENSORONIMERGED.config.suripcap.pcapMaxCount }}
}
{% endif %}
{%- else %}
}
{%- endif %}
}
}
}
}