From a5ae481ea4db1a9cf2e5ea22142bb5b5eb61b4a0 Mon Sep 17 00:00:00 2001
From: Mike Reeves <reevesmk@gmail.com>
Date: Wed, 26 Feb 2025 13:10:57 -0500
Subject: [PATCH] globals

---
 salt/global/soc_global.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/salt/global/soc_global.yaml b/salt/global/soc_global.yaml
index 5a349a3c3..15cae92b3 100644
--- a/salt/global/soc_global.yaml
+++ b/salt/global/soc_global.yaml
@@ -12,11 +12,18 @@ global:
   mdengine:
     description: Which engine to use for meta data generation. Options are ZEEK and SURICATA.
     regex: ^(ZEEK|SURICATA)$
+    options:
+      - ZEEK
+      - SURICATA
     regexFailureMessage: You must enter either ZEEK or SURICATA.
     global: True
   pcapengine:
     description: Which engine to use for generating pcap. Options are STENO, SURICATA or TRANSITION.
     regex: ^(STENO|SURICATA|TRANSITION)$
+    options:
+      - STENO
+      - SURICATA
+      - TRANSITION
     regexFailureMessage: You must enter either STENO, SURICATA or TRANSITION.
     global: True
   ids:
@@ -38,6 +45,9 @@ global:
   pipeline:
     description: Sets which pipeline technology for events to use. Currently only Redis is fully supported. Kafka is experimental and requires a Security Onion Pro license.
     regex: ^(REDIS|KAFKA)$
+    options:
+      - REDIS
+      - KAFKA
     regexFailureMessage: You must enter either REDIS or KAFKA.
     global: True
     advanced: True