CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 10:12:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fixes

Browse Source
This commit is contained in:
DefensiveDepth
2024-03-26 09:31:46 -04:00
parent cc0f4847ba
commit bbcd3116f7
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
salt/soc/soc_soc.yaml
View File

@@ -97,9 +97,7 @@ soc:
description: 'Custom Git repos to pull Sigma rules from. License field is required, folder is optional.' description: 'Custom Git repos to pull Sigma rules from. License field is required, folder is optional.'
global: True global: True
advanced: True advanced: True
multiline: True forcedType: "[]{}"
syntax: json
forcedType: "[]string"
helpLink: sigma.html helpLink: sigma.html
sigmaRulePackages: sigmaRulePackages:
description: 'Defines the Sigma Community Ruleset you want to run. One of these (core | core+ | core++ | all ) as well as an optional Add-on (emerging_threats_addon). WARNING! Changing the ruleset will remove all existing Sigma rules of the previous ruleset and their associated overrides. This removal cannot be undone.' description: 'Defines the Sigma Community Ruleset you want to run. One of these (core | core+ | core++ | all ) as well as an optional Add-on (emerging_threats_addon). WARNING! Changing the ruleset will remove all existing Sigma rules of the previous ruleset and their associated overrides. This removal cannot be undone.'
@@ -193,12 +191,10 @@ soc:
advanced: True advanced: True
helpLink: yara.html helpLink: yara.html
rulesRepos: rulesRepos:
description: 'Custom Git repos to pull Sigma rules from. License field is required' description: 'Custom Git repos to pull Yara rules from. License field is required'
global: True global: True
advanced: True advanced: True
multiline: True forcedType: "[]{}"
forcedType: "[]string"
syntax: json
helpLink: yara.html helpLink: yara.html
suricataengine: suricataengine:
allowRegex: allowRegex: