Rule Updates

salt/idstools/tools/sbin_jinja/so-rule-update

@@ -6,6 +6,8 @@
 {%- from 'idstools/map.jinja' import IDSTOOLSMERGED %}
 {%-   set proxy = salt['pillar.get']('manager:proxy') %}
 
+mkdir -p /nsm/rules/suricata
+
 # Download the rules from the internet
 {%- if GLOBALS.airgap != 'True' %}
 {%- if proxy %}

salt/strelka/config.sls

@@ -43,14 +43,14 @@ strelka_sbin:
     - group: 939
     - file_mode: 755
 
-#strelka_sbin_jinja:
-#  file.recurse:
-#    - name: /usr/sbin
-#    - source: salt://strelka/tools/sbin_jinja
-#    - user: 939
-#    - group: 939 
-#    - file_mode: 755
-#    - template: jinja
+strelka_sbin_jinja:
+  file.recurse:
+    - name: /usr/sbin
+    - source: salt://strelka/tools/sbin_jinja
+    - user: 939
+    - group: 939 
+    - file_mode: 755
+    - template: jinja
 
 {% else %}
 

salt/strelka/defaults.yaml

@@ -542,8 +542,7 @@ strelka:
     enabled: False
   rules:
     enabled: True
-    repos:
-      - https://github.com/Neo23x0/signature-base
+    repos: []
     excluded:
       - apt_flame2_orchestrator.yar
       - apt_tetris.yar

salt/strelka/tools/sbin_jinja/so-yara-update

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+. /usr/sbin/so-common
+
+{%- set proxy = salt['pillar.get']('manager:proxy') %}
+
+# Download the rules from the internet
+{%- if proxy %}
+export http_proxy={{ proxy }} 
+export https_proxy={{ proxy }} 
+export no_proxy= salt['pillar.get']('manager:no_proxy') 
+{%- endif %}
+
+mkdir -p /tmp/yara
+cd /tmp/yara
+git clone https://github.com/Security-Onion-Solutions/securityonion-yara.git
+mkdir -p /nsm/rules/yara
+rsync -shav --progress /tmp/yara/securityonion-yara/yara /nsm/rules/
+cd /tmp
+rm -rf /tmp/yara
+