Feature - auto-enabled Sigma rules

2025-12-06 17:22:49 +01:00 · 2024-04-03 08:21:50 -04:00
parent 7f488422b0
commit a8f25150f6
1 changed files with 4 additions and 0 deletions
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1216,6 +1216,10 @@ soc:
        elastalertengine:
          allowRegex: ''
          autoUpdateEnabled: true
+          autoEnabledSigmaRules:
+            - core+critical
+            - securityonion-resources+critical
+            - securityonion-resources+high
          communityRulesImportFrequencySeconds: 86400
          denyRegex: ''
          elastAlertRulesFolder: /opt/sensoroni/elastalert