Re-Work IDSTOOLS

salt/idstools/defaults.yaml

@@ -2,4 +2,8 @@ idstools:
   config:
     urls: []
     ruleset: ETOPEN
-    oinkcode: ""
+    oinkcode: ""
+  sids:
+	  enabled: []
+		isabled: []
+		modify: []

salt/idstools/etc/rulecat.conf

@@ -1,6 +1,6 @@
 {%- from 'vars/globals.map.jinja' import GLOBALS %}
 {%- import_yaml 'idstools/defaults.yaml' as IDSTOOLSDEFAULTS %}
-{%- set IDSTOOLSMERGED = salt['pillar.get']('idstools', IDSTOOLSDEFAULTS, merge=True) %}
+{%- set IDSTOOLSMERGED = salt['pillar.get']('idstools', IDSTOOLSDEFAULTS.idstools, merge=True) %}
 {%- if GLOBALS.airgap is sameas true -%}
 --merged=/opt/so/rules/nids/all.rules
 --local=/opt/so/rules/nids/local.rules