Merge remote-tracking branch 'remotes/origin/dev' into bugfix/playbook-mysql

2025-12-06 09:12:45 +01:00 · 2020-05-06 08:30:45 -04:00
parent 2e3bcf600f 981801f23c
commit bc34c67f47
46 changed files with 2733 additions and 2826 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,59 @@
+
+# Created by https://www.gitignore.io/api/macos,windows
+# Edit at https://www.gitignore.io/?templates=macos,windows
+
+### macOS ###
+# General
 .DS_Store
-.idea
+.AppleDouble
+.LSOverride
+
+# Icon must end with two \r
+Icon
+
+# Thumbnails
+._*
+
+# Files that might appear in the root of a volume
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns
+.com.apple.timemachine.donotpresent
+
+# Directories potentially created on remote AFP share
+.AppleDB
+.AppleDesktop
+Network Trash Folder
+Temporary Items
+.apdisk
+
+### Windows ###
+# Windows thumbnail cache files
+Thumbs.db
+Thumbs.db:encryptable
+ehthumbs.db
+ehthumbs_vista.db
+
+# Dump file
+*.stackdump
+
+# Folder config file
+[Dd]esktop.ini
+
+# Recycle Bin used on file shares
+$RECYCLE.BIN/
+
+# Windows Installer files
+*.cab
+*.msi
+*.msix
+*.msm
+*.msp
+
+# Windows shortcuts
+*.lnk
+
+# End of https://www.gitignore.io/api/macos,windows
--- a/pillar/top.sls
+++ b/pillar/top.sls
@@ -1,7 +1,10 @@
 base:
  '*':
    - patch.needs_restarting
-    - docker.config
+
+  '*_eval or *_helix or *_heavynode or *_sensor':
+    - match: compound
+    - zeek

  '*_mastersearch or *_heavynode':
    - match: compound
--- a/pillar/zeek/init.sls
+++ b/pillar/zeek/init.sls
@@ -0,0 +1,55 @@
+zeek:
+  zeekctl:
+    MailTo: root@localhost
+    MailConnectionSummary: 1
+    MinDiskSpace: 5
+    MailHostUpDown: 1
+    LogRotationInterval: 3600
+    LogExpireInterval: 0
+    StatsLogEnable: 1
+    StatsLogExpireInterval: 0
+    StatusCmdShowAll: 0
+    CrashExpireInterval: 0
+    SitePolicyScripts: local.zeek
+    LogDir: /nsm/zeek/logs
+    SpoolDir: /nsm/zeek/spool
+    CfgDir: /opt/zeek/etc
+    CompressLogs: 1
+  local:
+    '@load':
+      - misc/loaded-scripts
+      - tuning/defaults
+      - misc/capture-loss
+      - misc/stats
+      - frameworks/software/vulnerable
+      - frameworks/software/version-changes
+      - protocols/ftp/software
+      - protocols/smtp/software
+      - protocols/ssh/software
+      - protocols/http/software
+      - protocols/dns/detect-external-names
+      - protocols/ftp/detect
+      - protocols/conn/known-hosts
+      - protocols/conn/known-services
+      - protocols/ssl/known-certs
+      - protocols/ssl/validate-certs
+      - protocols/ssl/log-hostcerts-only
+      - protocols/ssh/geo-data
+      - protocols/ssh/detect-bruteforcing
+      - protocols/ssh/interesting-hostnames
+      - protocols/http/detect-sqli
+      - frameworks/files/hash-all-files
+      - frameworks/files/detect-MHR
+      - policy/frameworks/notice/extend-email/hostnames
+      - ja3
+      - hassh
+      - intel
+      - cve-2020-0601
+      - securityonion/bpfconf
+      - securityonion/communityid
+      - securityonion/file-extraction
+    '@load-sigs':
+      - frameworks/signatures/detect-windows-shells
+    redef:
+      - LogAscii::use_json = T;
+      - LogAscii::json_timestamps = JSON::TS_ISO8601;
--- a/salt/common/maps/broversion.map.jinja
+++ b/salt/common/maps/broversion.map.jinja
@@ -0,0 +1,5 @@
+{% set docker = {
+  'containers': [
+    'so-zeek'
+  ]
+} %}
--- a/salt/common/maps/domainstats.map.jinja
+++ b/salt/common/maps/domainstats.map.jinja
@@ -0,0 +1,5 @@
+{% set docker = {
+  'containers': [
+    'so-domainstats'
+  ]
+} %}
--- a/salt/common/maps/eval.map.jinja
+++ b/salt/common/maps/eval.map.jinja
@@ -0,0 +1,18 @@
+{% set docker = {
+  'containers': [
+    'so-nginx',
+    'so-telegraf',
+    'so-dockerregistry',
+    'so-soc',
+    'so-kratos',
+    'so-idstools',
+    'so-elasticsearch',
+    'so-kibana',
+    'so-steno',
+    'so-suricata',
+    'so-zeek',
+    'so-curator',
+    'so-elastalert',
+    'so-soctopus'
+  ]
+} %}
--- a/salt/common/maps/fleet.map.jinja
+++ b/salt/common/maps/fleet.map.jinja
@@ -0,0 +1,10 @@
+{% set docker = {
+  'containers': [
+    'so-mysql',
+    'so-fleet',
+    'so-redis',
+    'so-filebeat',
+    'so-nginx',
+    'so-telegraf'
+  ]
+} %}
--- a/salt/common/maps/fleet_master.map.jinja
+++ b/salt/common/maps/fleet_master.map.jinja
@@ -0,0 +1,7 @@
+{% set docker = {
+  'containers': [
+    'so-mysql',
+    'so-fleet',
+    'so-redis'
+  ]
+} %}
--- a/salt/common/maps/freq.map.jinja
+++ b/salt/common/maps/freq.map.jinja
@@ -0,0 +1,5 @@
+{% set docker = {
+  'containers': [
+    'so-freqserver'
+  ]
+} %}
--- a/salt/common/maps/grafana.map.jinja
+++ b/salt/common/maps/grafana.map.jinja
@@ -0,0 +1,6 @@
+{% set docker = {
+  'containers': [
+    'so-influxdb',
+    'so-grafana'
+  ]
+} %}
--- a/salt/common/maps/heavynode.map.jinja
+++ b/salt/common/maps/heavynode.map.jinja
@@ -0,0 +1,14 @@
+{% set docker = {
+  'containers': [
+    'so-nginx',
+    'so-telegraf',
+    'so-redis',
+    'so-logstash',
+    'so-elasticsearch',
+    'so-curator',
+    'so-steno',
+    'so-suricata',
+    'so-wazuh',
+    'so-filebeat
+  ]
+} %}
--- a/salt/common/maps/helixsensor.map.jinja
+++ b/salt/common/maps/helixsensor.map.jinja
@@ -0,0 +1,12 @@
+{% set docker = {
+  'containers': [
+    'so-nginx',
+    'so-telegraf',
+    'so-idstools',
+    'so-steno',
+    'so-zeek',
+    'so-redis',
+    'so-logstash',
+    'so-filebeat
+  ]
+} %}
--- a/salt/common/maps/hotnode.map.jinja
+++ b/salt/common/maps/hotnode.map.jinja
@@ -0,0 +1,9 @@
+{% set docker = {
+  'containers': [
+    'so-nginx',
+    'so-telegraf',
+     'so-logstash',
+    'so-elasticsearch',
+    'so-curator',
+   ]
+} %}
--- a/salt/common/maps/master.map.jinja
+++ b/salt/common/maps/master.map.jinja
@@ -0,0 +1,18 @@
+{% set docker = {
+  'containers': [
+    'so-dockerregistry',
+    'so-nginx',
+    'so-telegraf',
+    'so-soc',
+    'so-kratos',
+    'so-acng',
+    'so-idstools',
+    'so-redis',
+    'so-elasticsearch',
+    'so-logstash',
+    'so-kibana',
+    'so-elastalert',
+    'so-filebeat',
+    'so-soctopus'
+  ]
+} %}
--- a/salt/common/maps/mastersearch.map.jinja
+++ b/salt/common/maps/mastersearch.map.jinja
@@ -0,0 +1,18 @@
+{% set docker = {
+  'containers': [
+    'so-nginx',
+    'so-telegraf',
+    'so-soc',
+    'so-kratos',
+    'so-acng',
+    'so-idstools',
+    'so-redis',
+    'so-logstash',
+    'so-elasticsearch',
+    'so-curator',
+    'so-kibana',
+    'so-elastalert',
+    'so-filebeat',
+    'so-soctopus'
+  ]
+} %}
--- a/salt/common/maps/playbook.map.jinja
+++ b/salt/common/maps/playbook.map.jinja
@@ -0,0 +1,6 @@
+{% set docker = {
+  'containers': [
+    'so-playbook',
+    'so-navigator'
+  ]
+} %}
--- a/salt/common/maps/searchnode.map.jinja
+++ b/salt/common/maps/searchnode.map.jinja
@@ -0,0 +1,10 @@
+{% set docker = {
+  'containers': [
+    'so-nginx',
+    'so-telegraf',
+    'so-logstash',
+    'so-elasticsearch',
+    'so-curator',
+    'so-filebeat'
+  ]
+} %}
--- a/salt/common/maps/sensor.map.jinja
+++ b/salt/common/maps/sensor.map.jinja
@@ -0,0 +1,9 @@
+{% set docker = {
+  'containers': [
+    'so-nginx',
+    'so-telegraf',
+    'so-steno',
+    'so-suricata',
+    'so-filebeat'
+  ]
+} %}
--- a/salt/common/maps/so-status.map.jinja
+++ b/salt/common/maps/so-status.map.jinja
@@ -0,0 +1,61 @@
+{% set role = grains.id.split('_') | last %}
+{% from 'common/maps/'~ role ~'.map.jinja' import docker with context %}
+
+# Check if the service is enabled and append it's required containers
+# to the list predefined by the role / minion id affix
+{% macro append_containers(pillar_name, k, compare )%}
+  {% if salt['pillar.get'](pillar_name~':'~k, {}) != compare %}
+    {% from 'common/maps/'~k~'.map.jinja' import docker as d with context %}
+    {% for li in d['containers'] %}
+      {{ docker['containers'].append(li) }}
+    {% endfor %}
+  {% endif %}
+{% endmacro %}
+
+{% set docker = salt['grains.filter_by']({
+  '*_'~role: {
+    'containers': docker['containers']
+  } 
+},grain='id', merge=salt['pillar.get']('docker')) %}
+
+{% if role == 'eval' %}
+  {{ append_containers('master', 'grafana', 0) }}
+  {{ append_containers('static', 'fleet_master', 0) }}
+  {{ append_containers('master', 'wazuh', 0) }}
+  {{ append_containers('master', 'thehive', 0) }}
+  {{ append_containers('master', 'playbook', 0) }}
+  {{ append_containers('master', 'freq', 0) }}
+  {{ append_containers('master', 'domainstats', 0) }}
+{% endif %}
+
+{% if role == 'heavynode' %}
+  {{ append_containers('static', 'broversion', 'SURICATA') }}
+{% endif %}
+
+{% if role == 'mastersearch' %}
+  {{ append_containers('master', 'grafana', 0) }}
+  {{ append_containers('static', 'fleet_master', 0) }}
+  {{ append_containers('master', 'wazuh', 0) }}
+  {{ append_containers('master', 'thehive', 0) }}
+  {{ append_containers('master', 'playbook', 0) }}
+  {{ append_containers('master', 'freq', 0) }}
+  {{ append_containers('master', 'domainstats', 0) }}
+{% endif %}
+
+{% if role == 'master' %}
+  {{ append_containers('master', 'grafana', 0) }}
+  {{ append_containers('static', 'fleet_master', 0) }}
+  {{ append_containers('master', 'wazuh', 0) }}
+  {{ append_containers('master', 'thehive', 0) }}
+  {{ append_containers('master', 'playbook', 0) }}
+  {{ append_containers('master', 'freq', 0) }}
+  {{ append_containers('master', 'domainstats', 0) }}
+{% endif %}
+
+{% if role == 'searchnode' %}
+  {{ append_containers('master', 'wazuh', 0) }}
+{% endif %}
+
+{% if role == 'sensor' %}
+  {{ append_containers('static', 'broversion', 'SURICATA') }}
+{% endif %}
--- a/salt/common/maps/thehive.map.jinja
+++ b/salt/common/maps/thehive.map.jinja
@@ -0,0 +1,7 @@
+{% set docker = {
+  'containers': [
+    'so-thehive',
+    'so-thehive-es',
+    'so-cortex'
+  ]
+} %}
--- a/salt/common/maps/warmnode.map.jinja
+++ b/salt/common/maps/warmnode.map.jinja
@@ -0,0 +1,7 @@
+{% set docker = {
+  'containers': [
+    'so-nginx',
+    'so-telegraf',
+    'so-elasticsearch'
+  ]
+} %}
--- a/salt/common/maps/wazuh.map.jinja
+++ b/salt/common/maps/wazuh.map.jinja
@@ -0,0 +1,5 @@
+{% set docker = {
+  'containers': [
+    'so-wazuh'
+  ]
+} %}
--- a/salt/common/tools/sbin/so-status
+++ b/salt/common/tools/sbin/so-status
@@ -14,35 +14,8 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-{%- set pillar_suffix = ':containers' -%}
-{%- if (salt['grains.get']('role') == 'so-mastersearch') -%}
-    {%- set pillar_val = 'master_search' -%}
-{%- elif (salt['grains.get']('role') == 'so-master') -%}
-    {%- set pillar_val = 'master' -%}
-{%- elif (salt['grains.get']('role') == 'so-heavynode') -%}
-    {%- set pillar_val = 'heavy_node' -%}
-{%- elif (salt['grains.get']('role') == 'so-sensor') -%}
-    {%- set pillar_val = 'sensor' -%}
-{%- elif (salt['grains.get']('role') == 'so-eval') -%}
-    {%- set pillar_val = 'eval' -%}
-{%- elif (salt['grains.get']('role') == 'so-fleet') -%}
-    {%- set pillar_val = 'fleet' -%}
-{%- elif (salt['grains.get']('role') == 'so-helix') -%}
-    {%- set pillar_val = 'helix' -%}
-{%- elif (salt['grains.get']('role') == 'so-node') -%}
-    {%- if (salt['pillar.get']('node:node_type') == 'parser') -%}
-        {%- set pillar_val = 'parser_node' -%}
-    {%- elif (salt['pillar.get']('node:node_type') == 'hot') -%}
-        {%- set pillar_val = 'hot_node' -%}
-    {%- elif (salt['pillar.get']('node:node_type') == 'warm') -%}
-        {%- set pillar_val = 'warm_node' -%}
-    {%- elif (salt['pillar.get']('node:node_type') == 'search') -%}
-        {%- set pillar_val = 'search_node' -%}
-    {%- endif -%}
-{%- endif -%}
-{%- set pillar_name = pillar_val ~ pillar_suffix -%}
-{%- set container_list = salt['pillar.get'](pillar_name) %}
+{%- from 'common/maps/so-status.map.jinja' import docker with context %}
+{%- set container_list = docker['containers'] %}

 if ! [ "$(id -u)" = 0 ]; then
   echo "This command must be run as root"
--- a/salt/fleet/init.sls
+++ b/salt/fleet/init.sls
@@ -13,6 +13,9 @@
  {% set MAINIP = salt['pillar.get']('static:masterip') %}
 {% endif %}

+include:
+  - mysql
+
 #{% if grains.id.split('_')|last in ['master', 'eval', 'fleet'] %}
 #so/fleet:
 #  event.send:
@@ -86,6 +89,8 @@ fleetdb:
    - connection_port: 3306
    - connection_user: root
    - connection_pass: {{ MYSQLPASS }}
+    - require: 
+      - sls: mysql

 fleetdbuser:
  mysql_user.present:
@@ -95,6 +100,8 @@ fleetdbuser:
    - connection_port: 3306
    - connection_user: root
    - connection_pass: {{ MYSQLPASS }}
+    - require: 
+      - fleetdb

 fleetdbpriv:
  mysql_grants.present:
@@ -106,6 +113,8 @@ fleetdbpriv:
    - connection_port: 3306
    - connection_user: root
    - connection_pass: {{ MYSQLPASS }}
+    - require: 
+      - fleetdb


 {% if FLEETPASS == None or FLEETJWT == None %}
--- a/salt/kibana/bin/so-kibana-config-load
+++ b/salt/kibana/bin/so-kibana-config-load
@@ -1,6 +1,7 @@
 #!/bin/bash

 {%- set MASTER = salt['pillar.get']('static:masterip', '') %}
+{%- set FLEET_NODE = salt['pillar.get']('static:fleet_node') %}
 {%- set FLEET = salt['pillar.get']('static:fleet_ip', '') %}
 {%- set KRATOS = salt['pillar.get']('kratos:redirect', '') %}

@@ -28,8 +29,10 @@ cp /opt/so/conf/kibana/saved_objects.ndjson.template /opt/so/conf/kibana/saved_o
 # SOCtopus and Master
 sed -i "s/PLACEHOLDER/{{ MASTER }}/g" /opt/so/conf/kibana/saved_objects.ndjson

+{% if FLEET_NODE %}
 # Fleet IP
 sed -i "s/FLEETPLACEHOLDER/{{ FLEET }}/g" /opt/so/conf/kibana/saved_objects.ndjson
+{% endif %}

 # Kratos redirect
 sed -i "s/PCAPPLACEHOLDER/{{ KRATOS }}/g" /opt/so/conf/kibana/saved_objects.ndjson
--- a/salt/mysql/init.sls
+++ b/salt/mysql/init.sls
@@ -85,4 +85,9 @@ so-mysql:
      - /opt/so/log/mysql:/var/log/mysql:rw
    - watch:
      - /opt/so/conf/mysql/etc
+  cmd.run:
+    - name: until nc -z {{ MAINIP }} 3306; do sleep 1; done
+    - timeout: 120
+    - onchanges:
+      - docker_container: so-mysql
 {% endif %}
--- a/salt/nginx/etc/nginx.conf.so-eval
+++ b/salt/nginx/etc/nginx.conf.so-eval
@@ -146,6 +146,20 @@ http {

        }

+        location /cyberchef/ {
+          auth_request          /auth/sessions/whoami;
+          proxy_read_timeout    90;
+          proxy_connect_timeout 90;
+          proxy_set_header      Host $host;
+          proxy_set_header      X-Real-IP $remote_addr;
+          proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header      Proxy "";
+        }
+
+        location /cyberchef {
+          rewrite               ^ /cyberchef/ permanent;
+        }
+
        location /packages/ {
          try_files $uri =206;
          auth_request          /auth/sessions/whoami;
--- a/salt/nginx/etc/nginx.conf.so-master
+++ b/salt/nginx/etc/nginx.conf.so-master
@@ -146,6 +146,20 @@ http {

        }

+        location /cyberchef/ {
+          auth_request          /auth/sessions/whoami;
+          proxy_read_timeout    90;
+          proxy_connect_timeout 90;
+          proxy_set_header      Host $host;
+          proxy_set_header      X-Real-IP $remote_addr;
+          proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header      Proxy "";
+        }
+
+        location /cyberchef {
+          rewrite               ^ /cyberchef/ permanent;
+        }
+
        location /packages/ {
          try_files $uri =206;
          auth_request          /auth/sessions/whoami;
--- a/salt/nginx/etc/nginx.conf.so-mastersearch
+++ b/salt/nginx/etc/nginx.conf.so-mastersearch
@@ -146,6 +146,20 @@ http {

        }

+        location /cyberchef/ {
+          auth_request          /auth/sessions/whoami;
+          proxy_read_timeout    90;
+          proxy_connect_timeout 90;
+          proxy_set_header      Host $host;
+          proxy_set_header      X-Real-IP $remote_addr;
+          proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header      Proxy "";
+        }
+
+        location /cyberchef {
+          rewrite               ^ /cyberchef/ permanent;
+        }
+
        location /packages/ {
          try_files $uri =206;
          auth_request          /auth/sessions/whoami;
--- a/salt/top.sls
+++ b/salt/top.sls
@@ -21,7 +21,6 @@ base:
    - ssl
    - registry
    - common
-    - nginx
    - telegraf
    - firewall
    - idstools
@@ -37,7 +36,6 @@ base:
    - ca
    - ssl
    - common
-    - nginx
    - telegraf
    - firewall
    - pcap
@@ -192,7 +190,6 @@ base:
    - ca
    - ssl
    - common
-    - nginx
    - telegraf
    - firewall
    {%- if WAZUH != 0 %}
@@ -271,7 +268,6 @@ base:
    - ca
    - ssl
    - common
-    - nginx
    - telegraf
    - firewall
    - redis
--- a/salt/zeek/defaults.yml
+++ b/salt/zeek/defaults.yml
@@ -1,17 +0,0 @@
-zeek:
-  zeekctl:
-    MailTo: root@localhost
-    MailConnectionSummary: 1
-    MinDiskSpace: 5
-    MailHostUpDown: 1
-    LogRotationInterval: 3600
-    LogExpireInterval: 0
-    StatsLogEnable: 1
-    StatsLogExpireInterval: 0
-    StatusCmdShowAll: 0
-    CrashExpireInterval: 0
-    SitePolicyScripts: local.zeek
-    LogDir: /nsm/zeek/logs
-    SpoolDir: /nsm/zeek/spool
-    CfgDir: /opt/zeek/etc
-    CompressLogs: 1
--- a/salt/zeek/files/local.zeek
+++ b/salt/zeek/files/local.zeek
@@ -1,132 +0,0 @@
-##! Local site policy. Customize as appropriate.
-##!
-##! This file will not be overwritten when upgrading or reinstalling!
-
-# This script logs which scripts were loaded during each run.
-@load misc/loaded-scripts
-
-# Apply the default tuning scripts for common tuning settings.
-@load tuning/defaults
-
-# Estimate and log capture loss.
-@load misc/capture-loss
-
-# Enable logging of memory, packet and lag statistics.
-@load misc/stats
-
-# Load the scan detection script.  It's disabled by default because
-# it often causes performance issues.
-#@load misc/scan
-
-# Detect traceroute being run on the network. This could possibly cause
-# performance trouble when there are a lot of traceroutes on your network.
-# Enable cautiously.
-#@load misc/detect-traceroute
-
-# Generate notices when vulnerable versions of software are discovered.
-# The default is to only monitor software found in the address space defined
-# as "local".  Refer to the software framework's documentation for more
-# information.
-@load frameworks/software/vulnerable
-
-# Detect software changing (e.g. attacker installing hacked SSHD).
-@load frameworks/software/version-changes
-
-# This adds signatures to detect cleartext forward and reverse windows shells.
-@load-sigs frameworks/signatures/detect-windows-shells
-
-# Load all of the scripts that detect software in various protocols.
-@load protocols/ftp/software
-@load protocols/smtp/software
-@load protocols/ssh/software
-@load protocols/http/software
-# The detect-webapps script could possibly cause performance trouble when
-# running on live traffic.  Enable it cautiously.
-#@load protocols/http/detect-webapps
-
-# This script detects DNS results pointing toward your Site::local_nets
-# where the name is not part of your local DNS zone and is being hosted
-# externally.  Requires that the Site::local_zones variable is defined.
-@load protocols/dns/detect-external-names
-
-# Script to detect various activity in FTP sessions.
-@load protocols/ftp/detect
-
-# Scripts that do asset tracking.
-@load protocols/conn/known-hosts
-@load protocols/conn/known-services
-@load protocols/ssl/known-certs
-
-# This script enables SSL/TLS certificate validation.
-@load protocols/ssl/validate-certs
-
-# This script prevents the logging of SSL CA certificates in x509.log
-@load protocols/ssl/log-hostcerts-only
-
-# Uncomment the following line to check each SSL certificate hash against the ICSI
-# certificate notary service; see http://notary.icsi.berkeley.edu .
-# @load protocols/ssl/notary
-
-# If you have GeoIP support built in, do some geographic detections and
-# logging for SSH traffic.
-@load protocols/ssh/geo-data
-# Detect hosts doing SSH bruteforce attacks.
-@load protocols/ssh/detect-bruteforcing
-# Detect logins using "interesting" hostnames.
-@load protocols/ssh/interesting-hostnames
-
-# Detect SQL injection attacks.
-@load protocols/http/detect-sqli
-
-#### Network File Handling ####
-
-# Enable MD5 and SHA1 hashing for all files.
-@load frameworks/files/hash-all-files
-
-# Detect SHA1 sums in Team Cymru's Malware Hash Registry.
-@load frameworks/files/detect-MHR
-
-# Extend email alerting to include hostnames
-@load policy/frameworks/notice/extend-email/hostnames
-
-# Uncomment the following line to enable detection of the heartbleed attack. Enabling
-# this might impact performance a bit.
-# @load policy/protocols/ssl/heartbleed
-
-# Uncomment the following line to enable logging of connection VLANs. Enabling
-# this adds two VLAN fields to the conn.log file.
-# @load policy/protocols/conn/vlan-logging
-
-# Uncomment the following line to enable logging of link-layer addresses. Enabling
-# this adds the link-layer address for each connection endpoint to the conn.log file.
-# @load policy/protocols/conn/mac-logging
-
-# JA3 - SSL Detection Goodness
-@load ja3
-
-# HASSH
-@load hassh
-
-# You can load your own intel into:
-# /opt/so/saltstack/bro/policy/intel/ on the master
-@load intel
-
-# Load a custom Bro policy
-# /opt/so/saltstack/bro/policy/custom/ on the master
-#@load custom/somebropolicy.bro
-
-# Write logs in JSON
-redef LogAscii::use_json = T;
-redef LogAscii::json_timestamps = JSON::TS_ISO8601;
-
-# CVE-2020-0601
-@load cve-2020-0601
-
-# BPF Configuration
-@load securityonion/bpfconf
-
-# Community ID
-@load securityonion/communityid
-
-# Extracted files
-@load securityonion/file-extraction
--- a/salt/zeek/files/local.zeek.jinja
+++ b/salt/zeek/files/local.zeek.jinja
@@ -0,0 +1,11 @@
+##! Local site policy.
+
+{%- set ALLOWEDOPTIONS = [ '@load', '@load-sigs', 'redef' ] %}
+
+{%- for k, v in LOCAL.items() %}
+  {%- if k|lower in ALLOWEDOPTIONS %}
+    {%- for li in v|sort %}
+{{ k }} {{ li }}
+    {%- endfor %}
+  {%- endif %}
+{%- endfor %}
--- a/salt/zeek/files/zeekctl.cfg.jinja
+++ b/salt/zeek/files/zeekctl.cfg.jinja
@@ -2,7 +2,7 @@

 {%- set ALLOWEDOPTIONS = ['commtimeout','commandtimeout','compresscmd','compressextension','compresslogs','compresslogsinflight','controltopic','crashexpireinterval','croncmd','debug','env_vars','havenfs','keeplogs','logdir','logexpireinterval','logrotationinterval','mailalarmsinterval','mailalarmsto','mailarchivelogfail','mailconnectionsummary','mailfrom','mailhostupdown','mailreceivingpackets','mailreplyto','mailsubjectprefix','mailto','makearchivename','memlimit','mindiskspace','pfringclusterid','pfringclustertype','pfringfirstappinstance','prefixes','savetraces','sendmail','sitepluginpath','sitepolicypath','sitepolicyscripts','statslogenable','statslogexpireinterval','statuscmdshowall','stoptimeout','stopwait','timefmt','timemachinehost','timemachineport','zeekargs','zeekport','bindir','capstatspath','cfgdir','debuglog','defaultstoredir','helperdir','libdir','libdir64','libdirinternal','localnetscfg','lockfile','logexpireminutes','nodecfg','os','pcapbufsize','pcapsnaplen','plugindir','pluginzeekdir','policydir','policydirsiteinstall','policydirsiteinstallauto','postprocdir','scriptsdir','spooldir','standalone','statefile','staticdir','statsdir','statslog','time','tmpdir','tmpexecdir','tracesummary','version','zeek','zeekbase'] %}

-{%- for option in ZEEKCTL %}
+{%- for option in ZEEKCTL|sort %}
  {%- if option|lower in ALLOWEDOPTIONS %}
 {{ option }} = {{ ZEEKCTL[option] }}
  {%- endif %}
--- a/salt/zeek/init.sls
+++ b/salt/zeek/init.sls
@@ -4,8 +4,7 @@
 {% set BPF_STATUS = 0  %}
 {% set INTERFACE = salt['pillar.get']('sensor:interface', 'bond0') %}

-{% import_yaml 'zeek/defaults.yml' as ZEEKDEFAULTS %}
-{% set ZEEK = salt['pillar.get']('zeek', default=ZEEKDEFAULTS.zeek, merge=True) %}
+{% set ZEEK = salt['pillar.get']('zeek', {}) %}

 # Zeek Salt State

@@ -144,13 +143,16 @@ zeekbpf:
      - "ip or not ip"
 {% endif %}

+
 localzeeksync:
  file.managed:
    - name: /opt/so/conf/zeek/local.zeek
-    - source: salt://zeek/files/local.zeek
+    - source: salt://zeek/files/local.zeek.jinja
    - user: 937
    - group: 939
    - template: jinja
+    - defaults:
+        LOCAL: {{ ZEEK.local | tojson }}

 so-zeek:
  docker_container.running:
--- a/setup/install_scripts/99-so-checksum-offload-disable
+++ b/setup/install_scripts/99-so-checksum-offload-disable
@@ -1,6 +1,6 @@
 #!/bin/bash

-if [[ "$DEVICE_IFACE" != "$MAININT" && "$DEVICE_IFACE" != *"docker"* ]]; then
+if [[ "$DEVICE_IFACE" != "$MNIC" && "$DEVICE_IFACE" != *"docker"* ]]; then
 	for i in rx tx sg tso ufo gso gro lro; do
 		ethtool -K "$DEVICE_IFACE" "$i" off;
  	done
--- a/setup/public_keys/salt.pem
+++ b/setup/public_keys/salt.pem
@@ -0,0 +1,31 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2.0.22 (GNU/Linux)
+
+mQENBFOpvpgBCADkP656H41i8fpplEEB8IeLhugyC2rTEwwSclb8tQNYtUiGdna9
+m38kb0OS2DDrEdtdQb2hWCnswxaAkUunb2qq18vd3dBvlnI+C4/xu5ksZZkRj+fW
+tArNR18V+2jkwcG26m8AxIrT+m4M6/bgnSfHTBtT5adNfVcTHqiT1JtCbQcXmwVw
+WbqS6v/LhcsBE//SHne4uBCK/GHxZHhQ5jz5h+3vWeV4gvxS3Xu6v1IlIpLDwUts
+kT1DumfynYnnZmWTGc6SYyIFXTPJLtnoWDb9OBdWgZxXfHEcBsKGha+bXO+m2tHA
+gNneN9i5f8oNxo5njrL8jkCckOpNpng18BKXABEBAAG0MlNhbHRTdGFjayBQYWNr
+YWdpbmcgVGVhbSA8cGFja2FnaW5nQHNhbHRzdGFjay5jb20+iQE4BBMBAgAiBQJT
+qb6YAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAOCKFJ3le/vhkqB/0Q
+WzELZf4d87WApzolLG+zpsJKtt/ueXL1W1KA7JILhXB1uyvVORt8uA9FjmE083o1
+yE66wCya7V8hjNn2lkLXboOUd1UTErlRg1GYbIt++VPscTxHxwpjDGxDB1/fiX2o
+nK5SEpuj4IeIPJVE/uLNAwZyfX8DArLVJ5h8lknwiHlQLGlnOu9ulEAejwAKt9CU
+4oYTszYM4xrbtjB/fR+mPnYh2fBoQO4d/NQiejIEyd9IEEMd/03AJQBuMux62tjA
+/NwvQ9eqNgLw9NisFNHRWtP4jhAOsshv1WW+zPzu3ozoO+lLHixUIz7fqRk38q8Q
+9oNR31KvrkSNrFbA3D89uQENBFOpvpgBCADJ79iH10AfAfpTBEQwa6vzUI3Eltqb
+9aZ0xbZV8V/8pnuU7rqM7Z+nJgldibFk4gFG2bHCG1C5aEH/FmcOMvTKDhJSFQUx
+uhgxttMArXm2c22OSy1hpsnVG68G32Nag/QFEJ++3hNnbyGZpHnPiYgej3FrerQJ
+zv456wIsxRDMvJ1NZQB3twoCqwapC6FJE2hukSdWB5yCYpWlZJXBKzlYz/gwD/Fr
+GL578WrLhKw3UvnJmlpqQaDKwmV2s7MsoZogC6wkHE92kGPG2GmoRD3ALjmCvN1E
+PsIsQGnwpcXsRpYVCoW7e2nW4wUf7IkFZ94yOCmUq6WreWI4NggRcFC5ABEBAAGJ
+AR8EGAECAAkFAlOpvpgCGwwACgkQDgihSd5Xv74/NggA08kEdBkiWWwJZUZEy7cK
+WWcgjnRuOHd4rPeT+vQbOWGu6x4bxuVf9aTiYkf7ZjVF2lPn97EXOEGFWPZeZbH4
+vdRFH9jMtP+rrLt6+3c9j0M8SIJYwBL1+CNpEC/BuHj/Ra/cmnG5ZNhYebm76h5f
+T9iPW9fFww36FzFka4VPlvA4oB7ebBtquFg3sdQNU/MmTVV4jPFWXxh4oRDDR+8N
+1bcPnbB11b5ary99F/mqr7RgQ+YFF0uKRE3SKa7a+6cIuHEZ7Za+zhPaQlzAOZlx
+fuBmScum8uQTrEF5+Um5zkwC7EXTdH1co/+/V/fpOtxIg4XO4kcugZefVm5ERfVS
+MA==
+=dtMN
+-----END PGP PUBLIC KEY BLOCK-----
--- a/setup/so-common-functions
+++ b/setup/so-common-functions
@@ -0,0 +1,68 @@
+#!/bin/bash
+
+source ./so-variables
+
+# Helper functions
+
+filter_unused_nics() {
+
+	if [[ $MNIC ]]; then local grep_string="$MNIC\|bond0"; else local grep_string="bond0"; fi
+
+	# If we call this function and NICs have already been assigned to the bond interface then add them to the grep search string
+	if [[ $BNICS ]]; then
+		grep_string="$grep_string"
+		for BONDNIC in "${BNICS[@]}"; do
+			grep_string="$grep_string\|$BONDNIC"
+		done
+	fi
+
+	# Finally, set filtered_nics to any NICs we aren't using (and ignore interfaces that aren't of use)
+	filtered_nics=$(ip link| awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2}' | grep -vwe "$grep_string"  | sed 's/ //g')
+	readarray -t filtered_nics <<< "$filtered_nics"
+	
+	nic_list=()
+	for nic in "${filtered_nics[@]}"; do
+		nic_list+=("$nic" "" "OFF")
+	done
+
+	export nic_list
+}
+
+calculate_useable_cores() {
+
+	# Calculate reasonable core usage
+	local cores_for_bro=$(( (num_cpu_cores/2) - 1 ))
+	local lb_procs_round
+	lb_procs_round=$(printf "%.0f\n" $cores_for_bro)
+
+	if [ "$lb_procs_round" -lt 1 ]; then lb_procs=1; else lb_procs=$lb_procs_round; fi
+    export lb_procs
+}
+
+set_defaul_log_size() {
+    local percentage
+
+	case $INSTALLTYPE in
+		EVAL | HEAVYNODE)
+			percentage=50
+			;;
+		*)
+            percentage=80
+			;;
+		esac
+
+	local disk_dir="/"
+	if [ -d /nsm ]; then
+		disk_dir="/nsm"
+	fi
+	local disk_size_1k
+	disk_size_1k=$(df $disk_dir | grep -v "^Filesystem" | awk '{print $2}')
+
+    local ratio="1048576"
+
+    local disk_size_gb
+    disk_size_gb=$( echo "$disk_size_1k" "$ratio" | awk '{print($1/$2)}' )
+
+	log_size_limit=$( echo "$disk_size_gb" "$percentage" | awk '{printf("%.0f", $1 * ($2/100))}')
+	export log_size_limit
+}
--- a/setup/so-functions
+++ b/setup/so-functions
--- a/setup/so-setup
+++ b/setup/so-setup
--- a/setup/so-variables
+++ b/setup/so-variables
@@ -0,0 +1,36 @@
+#!/bin/bash
+
+total_mem=$(grep MemTotal /proc/meminfo | awk '{print $2}' | sed -r 's/.{3}$//')
+export total_mem
+
+total_mem_hr=$(grep MemTotal /proc/meminfo | awk '{ printf("%.0f", $2/1024/1024); }')
+export total_mem_hr
+
+num_cpu_cores=$(nproc)
+export num_cpu_cores
+
+readarray -t cpu_core_list <<< "$(grep "processor" /proc/cpuinfo | grep -v "KVM" | awk '{print $3}')"
+export cpu_core_list
+
+random_uid=$(</dev/urandom tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)
+export random_uid
+
+node_es_port=9200
+export node_es_port
+
+setup_log="/root/sosetup.log"
+export setup_log
+
+filesystem_root=$(df / | awk '$3 ~ /[0-9]+/ { print $2 * 1000 }')
+export filesystem_root
+
+mkdir -p /nsm
+filesystem_nsm=$(df /nsm | awk '$3 ~ /[0-9]+/ { print $2 * 1000 }')
+export filesystem_nsm
+
+mkdir -p /root/installtmp/pillar/minions
+export temp_install_dir=/root/installtmp
+
+export percentage_str='Getting started'
+
+export DEBIAN_FRONTEND=noninteractive
--- a/setup/so-whiptail
+++ b/setup/so-whiptail
@@ -15,20 +15,27 @@
 #    You should have received a copy of the GNU General Public License
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.

+source ./so-variables
+source ./so-common-functions
+
+
 whiptail_basic_bro() {

+	[ -n "$TESTING" ] && return
+
 	BASICBRO=$(whiptail --title "Security Onion Setup" --inputbox \
-  "Enter the number of bro processes:" 10 75 $LBPROCS 3>&1 1>&2 2>&3)
+	"Enter the number of bro processes:" 10 75 "$lb_procs" 3>&1 1>&2 2>&3)

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
-
 }

 whiptail_basic_suri() {

+	[ -n "$TESTING" ] && return
+
 	BASICSURI=$(whiptail --title "Security Onion Setup" --inputbox \
-  "Enter the number of Suricata Processes:" 10 75 $LBPROCS 3>&1 1>&2 2>&3)
+	"Enter the number of Suricata processes:" 10 75 "$lb_procs" 3>&1 1>&2 2>&3)

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
@@ -37,15 +44,26 @@ whiptail_basic_suri() {

 whiptail_bro_pins() {

-  BROPINS=$(whiptail --noitem --title "Pin Bro CPUS" --checklist "Please Select $LBPROCS cores to pin Bro to:" 20 75 12 ${LISTCORES[@]} 3>&1 1>&2 2>&3 )
+	[ -n "$TESTING" ] && return

+	local cpu_core_list_whiptail=()
+	for item in "${cpu_core_list[@]}"; do
+		cpu_core_list_whiptail+=("$item" "OFF")
+	done
+
+	BROPINS=$(whiptail --noitem --title "Pin Bro CPUS" --checklist "Please select $lb_procs cores to pin Bro to:" 20 75 12 "${cpu_core_list_whiptail[@]}" 3>&1 1>&2 2>&3 )
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

+	BROPINS=$(echo "$BROPINS" | tr -d '"')
+
+	IFS=' ' read -ra BROPINS <<< "$BROPINS"
 }

 whiptail_bro_version() {

+	[ -n "$TESTING" ] && return
+
 	BROVERSION=$(whiptail --title "Security Onion Setup" --radiolist "What tool would you like to use to generate meta data?" 20 75 4 "ZEEK" "Install Zeek (aka Bro)"  ON \
 	"SURICATA" "SUPER EXPERIMENTAL" OFF 3>&1 1>&2 2>&3)

@@ -56,26 +74,30 @@ whiptail_bro_version() {

 whiptail_bond_nics() {

-  local nic_list=()
-  for FNIC in ${FNICS[@]}; do
-    nic_list+=($FNIC "Interface" "OFF")
-  done
+	[ -n "$TESTING" ] && return

-  BNICS=$(whiptail --title "NIC Setup" --checklist "Please add NICs to the Monitor Interface" 20 75 12 ${nic_list[@]} 3>&1 1>&2 2>&3 )
+	filter_unused_nics
+
+	BNICS=$(whiptail --title "NIC Setup" --checklist "Please add NICs to the Monitor Interface" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3)
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

 	while [ -z "$BNICS" ]
 	do
-    BNICS=$(whiptail --title "NIC Setup" --checklist "Please add NICs to the Monitor Interface" 20 75 12 ${nic_list[@]} 3>&1 1>&2 2>&3 )
+		BNICS=$(whiptail --title "NIC Setup" --checklist "Please add NICs to the Monitor Interface" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 )
 		local exitstatus=$?
 		whiptail_check_exitstatus $exitstatus
 	done

+	BNICS=$(echo "$BNICS" | tr -d '"')
+
+	IFS=' ' read -ra BNICS <<< "$BNICS"
 }

 whiptail_bond_nics_mtu() {

+	[ -n "$TESTING" ] && return
+
 	# Set the MTU on the monitor interface
 	MTU=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Enter the MTU for the monitor NICs" 10 75 1500 3>&1 1>&2 2>&3)
@@ -89,25 +111,32 @@ whiptail_cancel() {

 	whiptail --title "Security Onion Setup" --msgbox "Cancelling Setup. No changes have been made." 8 75
 	if [ -d "/root/installtmp" ]; then
-    echo "/root/installtmp exists" >> $SETUPLOG 2>&1
-    install_cleanup >> $SETUPLOG 2>&1
-    echo "/root/installtmp removed" >> $SETUPLOG 2>&1
+		{
+			echo "/root/installtmp exists";
+			install_cleanup;
+			echo "/root/installtmp removed";
+		} >> $setup_log 2>&1
 	fi
 	exit

 }

 whiptail_check_exitstatus() {
-
-  if [ $1 == '1' ]; then
-    echo "They hit cancel"
+	case $1 in
+		1)
 			whiptail_cancel
-  fi
-
+			;;
+		255)
+			whiptail --title "Security Onion Setup" --msgbox "Whiptail error occured, exiting. Check log for details." 8 75
+			exit
+			;;
+	esac
 }

 whiptail_create_admin_user() {

+	[ -n "$TESTING" ] && return
+
 	ADMINUSER=$(whiptail --title "Security Onion Install" --inputbox \
 	"Please enter a username for your new admin user. The onion account will be disabled during this install" 10 60 3>&1 1>&2 2>&3)

@@ -115,6 +144,8 @@ whiptail_create_admin_user() {

 whiptail_create_admin_user_password1() {

+	[ -n "$TESTING" ] && return
+
 	ADMINPASS1=$(whiptail --title "Security Onion Install" --passwordbox \
 	"Enter a password for $ADMINUSER" 10 60 3>&1 1>&2 2>&3)

@@ -124,6 +155,8 @@ whiptail_create_admin_user_password1() {

 whiptail_create_admin_user_password2() {

+	[ -n "$TESTING" ] && return
+
 	ADMINPASS2=$(whiptail --title "Security Onion Install" --passwordbox \
 	"Re-enter a password for $ADMINUSER" 10 60 3>&1 1>&2 2>&3)

@@ -134,12 +167,16 @@ whiptail_create_admin_user_password2() {

 whiptail_create_soremote_user() {

+	[ -n "$TESTING" ] && return
+
 	whiptail --title "Security Onion Setup" --msgbox "Set a password for the soremote user. This account is used for adding sensors remotely." 8 75

 }

 whiptail_create_soremote_user_password1() {

+	[ -n "$TESTING" ] && return
+
 	SOREMOTEPASS1=$(whiptail --title "Security Onion Install" --passwordbox \
 	"Enter a password for user soremote" 10 75 3>&1 1>&2 2>&3)

@@ -150,6 +187,8 @@ whiptail_create_soremote_user_password1() {

 whiptail_create_soremote_user_password2() {

+	[ -n "$TESTING" ] && return	
+
 	SOREMOTEPASS2=$(whiptail --title "Security Onion Install" --passwordbox \
 	"Re-enter a password for user soremote" 10 75 3>&1 1>&2 2>&3)

@@ -160,6 +199,8 @@ whiptail_create_soremote_user_password2() {

 whiptail_create_web_user() {

+	[ -n "$TESTING" ] && return
+
 	WEBUSER=$(whiptail --title "Security Onion Install" --inputbox \
 	"Please enter an email address to create an administrator account for the web interface." 10 60 3>&1 1>&2 2>&3)

@@ -168,11 +209,16 @@ whiptail_create_web_user() {
 }

 whiptail_invalid_user_warning() {
+
+	[ -n "$TESTING" ] && return
+	
 	whiptail --title "Security Onion Setup" --msgbox "Please enter a valid email address." 8 75
 }

 whiptail_create_web_user_password1() {

+	[ -n "$TESTING" ] && return
+
 	WEBPASSWD1=$(whiptail --title "Security Onion Install" --passwordbox \
 	"Enter a password for $WEBUSER" 10 60 3>&1 1>&2 2>&3)

@@ -182,6 +228,8 @@ whiptail_create_web_user_password1() {

 whiptail_create_web_user_password2() {

+	[ -n "$TESTING" ] && return
+
 	WEBPASSWD2=$(whiptail --title "Security Onion Install" --passwordbox \
 	"Re-enter a password for $WEBUSER" 10 60 3>&1 1>&2 2>&3)

@@ -190,12 +238,32 @@ whiptail_create_web_user_password2() {

 }

+whiptail_requirements_error() {
+
+	local requirement_needed=$1
+	local current_val=$2
+	local needed_val=$3
+
+	[ -n "$TESTING" ] && return
+
+	whiptail --title "Security Onion Setup" \
+	--yesno "This machine currently has $current_val $requirement_needed, but needs $needed_val to meet minimum requirements. Press YES to continue anyway, or press NO to cancel."  8 75
+
+	local exitstatus=$?
+	whiptail_check_exitstatus $exitstatus
+}
+
 whiptail_invalid_pass_warning() {
+
+	[ -n "$TESTING" ] && return
+
 	whiptail --title "Security Onion Setup" --msgbox "Please choose a more secure password." 8 75
 }

 whiptail_cur_close_days() {

+	[ -n "$TESTING" ] && return
+
 	CURCLOSEDAYS=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Please specify the threshold (in days) at which Elasticsearch indices will be closed" 10 75 $CURCLOSEDAYS 3>&1 1>&2 2>&3)

@@ -206,31 +274,48 @@ whiptail_cur_close_days() {

 whiptail_dhcp_or_static() {

-  ADDRESSTYPE=$(whiptail --title "Security Onion Setup" --radiolist \
+	[ -n "$TESTING" ] && return
+
+	address_type=$(whiptail --title "Security Onion Setup" --radiolist \
 	"Choose how to set up your management interface:" 20 78 4 \
 	"STATIC" "Set a static IPv4 address" ON  \
 	"DHCP" "Use DHCP to configure the Management Interface" OFF 3>&1 1>&2 2>&3 )
-
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
+
+	export address_type
+
 }

 whiptail_enable_components() {
+
+	[ -n "$TESTING" ] && return
+
 	COMPONENTS=$(whiptail --title "Security Onion Setup" --checklist \
 	"Select Components to install" 20 75 8 \
-  "GRAFANA" "Enable Grafana for system monitoring" ON \
-  "OSQUERY" "Enable Fleet with osquery" ON \
-  "WAZUH" "Enable Wazuh" ON \
-  "THEHIVE" "Enable TheHive" ON \
-  "PLAYBOOK" "Enable Playbook" ON \
-  "STRELKA" "Enable Strelka" ON 3>&1 1>&2 2>&3 )
-
+	GRAFANA "Enable Grafana for system monitoring" ON \
+	OSQUERY "Enable Fleet with osquery" ON \
+	WAZUH "Enable Wazuh" ON \
+	THEHIVE "Enable TheHive" ON \
+	PLAYBOOK "Enable Playbook" ON \
+	STRELKA "Enable Strelka" ON 3>&1 1>&2 2>&3)
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

+	COMPONENTS=$(echo "$COMPONENTS" | tr -d '"')
+
+	IFS=' ' read -ra COMPONENTS <<< "$COMPONENTS"
+
+	# Set any variables to 1 if they exist in COMPONENTS
+	for component in "${COMPONENTS[@]}"; do
+    	export "$component=1"
+	done
 }

 whiptail_eval_adv() {
+
+	[ -n "$TESTING" ] && return
+
 	EVALADVANCED=$(whiptail --title "Security Onion Setup" --radiolist \
 	"Choose your eval install:" 20 75 4 \
 	"BASIC" "Install basic components for evaluation" ON  \
@@ -240,11 +325,17 @@ whiptail_eval_adv() {
 	whiptail_check_exitstatus $exitstatus
 }

-whiptail_eval_adv_warning() {
+whiptail_components_adv_warning() {
+
+	[ -n "$TESTING" ] && return
+
 	whiptail --title "Security Onion Setup" --msgbox "Please keep in mind the more services that you enable the more RAM that is required." 8 75
 }

 whiptail_helix_apikey() {
+
+	[ -n "$TESTING" ] && return
+
 	HELIXAPIKEY=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Enter your Helix API Key: \n \nThis can be set later using so-helix-apikey" 10 75 3>&1 1>&2 2>&3)

@@ -255,36 +346,45 @@ whiptail_helix_apikey() {

 whiptail_homenet_master() {

-  # Ask for the HOME_NET on the master
+	[ -n "$TESTING" ] && return
+
 	HNMASTER=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Enter your HOME_NET separated by ," 10 75 10.0.0.0/8,192.168.0.0/16,172.16.0.0/12 3>&1 1>&2 2>&3)
-
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

+	export HNMASTER
 }

 whiptail_homenet_sensor() {

+	[ -n "$TESTING" ] && return
+
 	# Ask to inherit from master
 	whiptail --title "Security Onion Setup" --yesno "Do you want to inherit the HOME_NET from the Master?" 8 75

 	local exitstatus=$?
+
 	if [ $exitstatus == 0 ]; then
-    HNSENSOR=inherit
+		export HNSENSOR=inherit
 	else
 		HNSENSOR=$(whiptail --title "Security Onion Setup" --inputbox \
 		"Enter your HOME_NET separated by ," 10 75 10.0.0.0/8,192.168.0.0/16,172.16.0.0/12 3>&1 1>&2 2>&3)
 		local exitstatus=$?
 		whiptail_check_exitstatus $exitstatus
+
+		export HNSENSOR
+
 	fi

 }

 whiptail_install_type() {

+	[ -n "$TESTING" ] && return
+
 	# What kind of install are we doing?
-  INSTALLTYPE=$(whiptail --title "Security Onion Setup" --radiolist \
+	install_type=$(whiptail --title "Security Onion Setup" --radiolist \
 	"Choose Install Type:" 20 75 13 \
 	"SENSOR" "Create a forward only sensor" ON \
 	"SEARCHNODE" "Add a Search Node with parsing" OFF \
@@ -303,13 +403,20 @@ whiptail_install_type() {
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

+	export install_type
+
+
 }

 whiptail_log_size_limit() {

-   LOG_SIZE_LIMIT=$(whiptail --title "Security Onion Setup" --inputbox \
+	[ -n "$TESTING" ] && return
+	
+	set_defaul_log_size
+
+	log_size_limit=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Please specify the amount of disk space (in GB) you would like to allocate for Elasticsearch data storage. \
-  By default, this is set to 80% of the disk space allotted for /nsm." 10 75 $LOG_SIZE_LIMIT 3>&1 1>&2 2>&3)
+	By default, this is set to 80% of the disk space allotted for /nsm." 10 75 "$log_size_limit" 3>&1 1>&2 2>&3)

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
@@ -318,6 +425,8 @@ whiptail_log_size_limit() {

 whiptail_management_interface_dns() {

+	[ -n "$TESTING" ] && return
+
 	MDNS=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Enter your DNS server using space between multiple" 10 60 8.8.8.8 8.8.4.4 3>&1 1>&2 2>&3)

@@ -325,6 +434,8 @@ whiptail_management_interface_dns() {

 whiptail_management_interface_dns_search() {

+	[ -n "$TESTING" ] && return
+
 	MSEARCH=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Enter your DNS search domain" 10 60 searchdomain.local 3>&1 1>&2 2>&3)

@@ -332,6 +443,8 @@ whiptail_management_interface_dns_search() {

 whiptail_management_interface_gateway() {

+	[ -n "$TESTING" ] && return
+
 	MGATEWAY=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Enter your gateway" 10 60 X.X.X.X 3>&1 1>&2 2>&3)

@@ -339,6 +452,8 @@ whiptail_management_interface_gateway() {

 whiptail_management_interface_ip() {

+	[ -n "$TESTING" ] && return
+
 	MIP=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Enter your IP address" 10 60 X.X.X.X 3>&1 1>&2 2>&3)

@@ -346,6 +461,8 @@ whiptail_management_interface_ip() {

 whiptail_management_interface_mask() {

+	[ -n "$TESTING" ] && return
+
 	MMASK=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Enter the bit mask for your subnet" 10 60 24 3>&1 1>&2 2>&3)

@@ -353,13 +470,17 @@ whiptail_management_interface_mask() {

 whiptail_management_nic() {

-  MNIC=$(whiptail --title "NIC Setup" --radiolist "Please select your management NIC" 20 75 12 ${NICS[@]} 3>&1 1>&2 2>&3 )
+	[ -n "$TESTING" ] && return
+
+	filter_unused_nics
+
+	MNIC=$(whiptail --title "NIC Setup" --radiolist "Please select your management NIC" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 )	
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

 	while [ -z "$MNIC" ]
 	do
-    MNIC=$(whiptail --title "NIC Setup" --radiolist "Please select your management NIC" 20 75 12 ${NICS[@]} 3>&1 1>&2 2>&3 )
+		MNIC=$(whiptail --title "NIC Setup" --radiolist "Please select your management NIC" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 )	
 		local exitstatus=$?
 		whiptail_check_exitstatus $exitstatus
 	done
@@ -368,6 +489,8 @@ whiptail_management_nic() {

 whiptail_nids() {

+	[ -n "$TESTING" ] && return
+
 	NIDS=$(whiptail --title "Security Onion Setup" --radiolist \
 	"Choose which IDS to run:" 20 75 4 \
 	"Suricata" "Suricata 4.X" ON  \
@@ -380,6 +503,8 @@ whiptail_nids() {

 whiptail_oinkcode() {

+	[ -n "$TESTING" ] && return
+
 	OINKCODE=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Enter your oinkcode" 10 75 XXXXXXX 3>&1 1>&2 2>&3)

@@ -390,7 +515,9 @@ whiptail_oinkcode() {

 whiptail_make_changes() {

-  whiptail --title "Security Onion Setup" --yesno "We are going to set this machine up as a $INSTALLTYPE. Please hit YES to make changes or NO to cancel." 8 75
+	[ -n "$TESTING" ] && return
+
+	whiptail --title "Security Onion Setup" --yesno "We are going to set this machine up as a $install_type. Please press YES to make changes or NO to cancel." 8 75

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
@@ -399,16 +526,15 @@ whiptail_make_changes() {

 whiptail_management_server() {

+	[ -n "$TESTING" ] && return
+
 	MSRV=$(whiptail --title "Security Onion Setup" --inputbox \
-  "Enter your Master Server HOSTNAME. It is CASE SENSITIVE!" 10 75 XXXX 3>&1 1>&2 2>&3)
+	"Enter your Master Server hostname. It is CASE SENSITIVE!" 10 75 XXXX 3>&1 1>&2 2>&3)

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

-  # See if it resolves. Otherwise prompt to add to host file
-  TESTHOST=$(host $MSRV)
-
-  if [[ $TESTHOST = *"not found"* ]] || [ -z $TESTHOST ] || [[ $TESTHOST = *"connection timed out"* ]]; then
+	if ! getent hosts "$MSRV"; then
 		add_master_hostfile
 	fi

@@ -417,6 +543,8 @@ whiptail_management_server() {
 # Ask if you want to do advanced setup of the Master
 whiptail_master_adv() {

+	[ -n "$TESTING" ] && return
+
 	MASTERADV=$(whiptail --title "Security Onion Setup" --radiolist \
 	"Choose what type of master install:" 20 75 4 \
 	"BASIC" "Install master with recommended settings" ON  \
@@ -430,7 +558,9 @@ whiptail_master_adv() {
 # Ask which additional components to install
 whiptail_master_adv_service_brologs() {

-  BLOGS=$(whiptail --title "Security Onion Setup" --checklist "Please Select Logs to Send:" 24 75 12 \
+	[ -n "$TESTING" ] && return
+
+	BLOGS=$(whiptail --title "Security Onion Setup" --checklist "Please select Logs to Send:" 24 75 12 \
 	"conn" "Connection Logging" ON \
 	"dce_rpc" "RPC Logs" ON \
 	"dhcp" "DHCP Logs" ON \
@@ -468,16 +598,22 @@ whiptail_master_adv_service_brologs() {
 	"weird" "Zeek Weird Logs" ON \
 	"mysql" "MySQL Logs" ON \
 	"socks" "SOCKS Logs" ON \
-  "x509" "x.509 Logs" ON 3>&1 1>&2 2>&3 )
+	"x509" "x.509 Logs" ON 3>&1 1>&2 2>&3)

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

+	BLOGS=$(echo "$BLOGS" | tr -d '"')
+
+	IFS=' ' read -ra BLOGS <<< "$BLOGS"
+
 }

 whiptail_network_notice() {

-  whiptail --title "Security Onion Setup" --yesno "Since this is a network install we assume the management interface, DNS, Hostname, etc are already set up. Hit YES to continue." 8 75
+	[ -n "$TESTING" ] && return
+
+	whiptail --title "Security Onion Setup" --yesno "Since this is a network install we assume the management interface, DNS, Hostname, etc are already set up. Press YES to continue." 8 75

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
@@ -486,6 +622,8 @@ whiptail_network_notice() {

 whiptail_node_advanced() {

+	[ -n "$TESTING" ] && return
+
 	NODESETUP=$(whiptail --title "Security Onion Setup" --radiolist \
 	"What type of config would you like to use?:" 20 75 4 \
 	"NODEBASIC" "Install Search Node with recommended settings" ON \
@@ -498,7 +636,8 @@ whiptail_node_advanced() {

 whiptail_node_es_heap() {

-  es_heapsize
+	[ -n "$TESTING" ] && return
+
 	NODE_ES_HEAP_SIZE=$(whiptail --title "Security Onion Setup" --inputbox \
 	"\nEnter ES Heap Size: \n \n(Recommended value is pre-populated)" 10 75 $ES_HEAP_SIZE 3>&1 1>&2 2>&3)

@@ -509,7 +648,8 @@ whiptail_node_es_heap() {

 whiptail_node_ls_heap() {

-  ls_heapsize
+	[ -n "$TESTING" ] && return
+
 	NODE_LS_HEAP_SIZE=$(whiptail --title "Security Onion Setup" --inputbox \
 	"\nEnter LogStash Heap Size: \n \n(Recommended value is pre-populated)" 10 75 $LS_HEAP_SIZE 3>&1 1>&2 2>&3)

@@ -520,8 +660,10 @@ whiptail_node_ls_heap() {

 whiptail_node_ls_pipeline_worker() {

+	[ -n "$TESTING" ] && return
+
 	LSPIPELINEWORKERS=$(whiptail --title "Security Onion Setup" --inputbox \
-  "\nEnter LogStash Pipeline Workers: \n \n(Recommended value is pre-populated)" 10 75 $CPUCORES 3>&1 1>&2 2>&3)
+	"\nEnter LogStash Pipeline Workers: \n \n(Recommended value is pre-populated)" 10 75 "$num_cpu_cores" 3>&1 1>&2 2>&3)

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
@@ -530,6 +672,8 @@ whiptail_node_ls_pipeline_worker() {

 whiptail_node_ls_pipline_batchsize() {

+	[ -n "$TESTING" ] && return
+
 	LSPIPELINEBATCH=$(whiptail --title "Security Onion Setup" --inputbox \
 	"\nEnter LogStash Pipeline Batch Size: \n \n(Default value is pre-populated)" 10 75 125 3>&1 1>&2 2>&3)

@@ -540,6 +684,8 @@ whiptail_node_ls_pipline_batchsize() {

 whiptail_node_ls_input_threads() {

+	[ -n "$TESTING" ] && return
+
 	LSINPUTTHREADS=$(whiptail --title "Security Onion Setup" --inputbox \
 		"\nEnter LogStash Input Threads: \n \n(Default value is pre-populated)" 10 75 1 3>&1 1>&2 2>&3)

@@ -550,6 +696,8 @@ whiptail_node_ls_input_threads() {

 whiptail_node_ls_input_batch_count() {

+	[ -n "$TESTING" ] && return
+
 	LSINPUTBATCHCOUNT=$(whiptail --title "Security Onion Setup" --inputbox \
 	"\nEnter LogStash Input Batch Count: \n \n(Default value is pre-populated)" 10 75 125 3>&1 1>&2 2>&3)

@@ -558,6 +706,10 @@ whiptail_node_ls_input_batch_count() {

 }

+
+#TODO: helper function to display error message or exit if batch mode
+# exit_if_batch <"Error string"> <Error code (int)>
+
 whiptail_passwords_dont_match() {

 	whiptail --title "Security Onion Setup" --msgbox "Passwords don't match. Please re-enter." 8 75
@@ -566,6 +718,8 @@ whiptail_passwords_dont_match() {

 whiptail_patch_name_new_schedule() {

+	[ -n "$TESTING" ] && return
+
 	PATCHSCHEDULENAME=$(whiptail --title "Security Onion Setup" --inputbox \
 	"What name do you want to give this OS patch schedule? This schedule needs to be named uniquely. Available schedules can be found on the master under /opt/so/salt/patch/os/schedules/<schedulename>.yml" 10 75 3>&1 1>&2 2>&3)

@@ -585,8 +739,10 @@ whiptail_patch_name_new_schedule() {

 whiptail_patch_schedule() {

-  # What kind of patch schedule are we doing?
-  PATCHSCHEDULE=$(whiptail --title "Security Onion Setup" --radiolist \
+	[ -n "$TESTING" ] && return
+
+	local patch_schedule
+	patch_schedule=$(whiptail --title "Security Onion Setup" --radiolist \
 	"Choose OS patch schedule. This will NOT update Security Onion related tools such as Zeek, Elasticsearch, Kibana, SaltStack, etc." 15 75 5 \
 	"Automatic" "Updates installed every 8 hours if available" ON \
 	"Manual" "Updates will be installed manually" OFF \
@@ -596,10 +752,32 @@ whiptail_patch_schedule() {
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

+
+	case $patch_schedule in
+	'New Schedule')
+		whiptail_patch_schedule_select_days
+		whiptail_patch_schedule_select_hours
+		whiptail_patch_name_new_schedule
+		patch_schedule_os_new
+		;;
+	'Import Schedule')
+		whiptail_patch_schedule_import
+		;;
+	'Automatic')
+		PATCHSCHEDULENAME='auto'
+		;;
+	'Manual')
+		PATCHSCHEDULENAME='manual'
+		;;
+	esac
+
+
 }

 whiptail_patch_schedule_import() {

+	[ -n "$TESTING" ] && return
+
 	unset PATCHSCHEDULENAME
 	PATCHSCHEDULENAME=$(whiptail --title "Security Onion Setup" --inputbox \
 	"Enter the name of the OS patch schedule you want to inherit. Available schedules can be found on the master under /opt/so/salt/patch/os/schedules/<schedulename>.yml" 10 75 3>&1 1>&2 2>&3)
@@ -619,63 +797,81 @@ whiptail_patch_schedule_import() {
 }

 whiptail_patch_schedule_select_days() {
+	
+	[ -n "$TESTING" ] && return
+
 	 # Select the days to patch
-  PATCHSCHEDULEDAYS=($(whiptail --title "Security Onion Setup" --checklist \
+	PATCHSCHEDULEDAYS=$(whiptail --title "Security Onion Setup" --checklist \
 	"Which days do you want to apply OS patches?" 15 75 8 \
-  "Monday" "" OFF \
-  "Tuesday" "" ON \
-  "Wednesday" "" OFF \
-  "Thursday" "" OFF \
-  "Friday" "" OFF \
-  "Saturday" "" OFF \
-  "Sunday" "" OFF 3>&1 1>&2 2>&3 ))
+	Monday "" OFF \
+	Tuesday "" ON \
+	Wednesday "" OFF \
+	Thursday "" OFF \
+	Friday "" OFF \
+	Saturday "" OFF \
+	Sunday "" OFF 3>&1 1>&2 2>&3)

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
+
+	PATCHSCHEDULEDAYS=$(echo "$PATCHSCHEDULEDAYS" | tr -d '"')
+
+	IFS=' ' read -ra PATCHSCHEDULEDAYS <<< "$PATCHSCHEDULEDAYS"
+
 }

 whiptail_patch_schedule_select_hours() {
+	
+	[ -n "$TESTING" ] && return
+
 	# Select the hours to patch
-  PATCHSCHEDULEHOURS=($(whiptail --title "Security Onion Setup" --checklist \
+	PATCHSCHEDULEHOURS=$(whiptail --title "Security Onion Setup" --checklist \
 	"At which time, UTC, do you want to apply OS patches on the selected days? Hours 12 through 23 can be selected on the next screen." 22 75 13 \
-  "00:00" "" OFF \
-  "01:00" "" OFF \
-  "02:00" "" OFF \
-  "03:00" "" OFF \
-  "04:00" "" OFF \
-  "05:00" "" OFF \
-  "06:00" "" OFF \
-  "07:00" "" OFF \
-  "08:00" "" OFF \
-  "09:00" "" OFF \
-  "10:00" "" OFF \
-  "11:00" "" OFF 3>&1 1>&2 2>&3 ))
+	00:00 "" OFF \
+	01:00 "" OFF \
+	02:00 "" OFF \
+	03:00 "" OFF \
+	04:00 "" OFF \
+	05:00 "" OFF \
+	06:00 "" OFF \
+	07:00 "" OFF \
+	08:00 "" OFF \
+	09:00 "" OFF \
+	10:00 "" OFF \
+	11:00 "" OFF 3>&1 1>&2 2>&3 )

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

 	# Select the hours to patch
-  PATCHSCHEDULEHOURS+=($(whiptail --title "Security Onion Setup" --checklist \
+	PATCHSCHEDULEHOURS+=$(whiptail --title "Security Onion Setup" --checklist \
 	"At which time, UTC, do you want to apply OS patches on the selected days?" 22 75 13 \
-  "12:00" "" OFF \
-  "13:00" "" OFF \
-  "14:00" "" OFF \
-  "15:00" "" ON \
-  "16:00" "" OFF \
-  "17:00" "" OFF \
-  "18:00" "" OFF \
-  "19:00" "" OFF \
-  "20:00" "" OFF \
-  "21:00" "" OFF \
-  "22:00" "" OFF \
-  "23:00" "" OFF 3>&1 1>&2 2>&3 ))
+	12:00 "" OFF \
+	13:00 "" OFF \
+	14:00 "" OFF \
+	15:00 "" ON \
+	16:00 "" OFF \
+	17:00 "" OFF \
+	18:00 "" OFF \
+	19:00 "" OFF \
+	20:00 "" OFF \
+	21:00 "" OFF \
+	22:00 "" OFF \
+	23:00 "" OFF 3>&1 1>&2 2>&3)

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
+
+	PATCHSCHEDULEHOURS=$(echo "$PATCHSCHEDULEHOURS" | tr -d '"')
+
+	IFS=' ' read -ra PATCHSCHEDULEHOURS <<< "$PATCHSCHEDULEHOURS"
+
 }

 whiptail_rule_setup() {

+	[ -n "$TESTING" ] && return
+
 	# Get pulled pork info
 	RULESETUP=$(whiptail --title "Security Onion Setup" --radiolist \
 	"Which IDS ruleset would you like to use?\n\nThis master server is responsible for downloading the IDS ruleset from the Internet.\n\nSensors then pull a copy of this ruleset from the master server.\n\nIf you select a commercial ruleset, it is your responsibility to purchase enough licenses for all of your sensors in compliance with your vendor's policies." 20 75 4 \
@@ -692,6 +888,8 @@ whiptail_rule_setup() {

 whiptail_sensor_config() {

+	[ -n "$TESTING" ] && return
+
 	NSMSETUP=$(whiptail --title "Security Onion Setup" --radiolist \
 	"What type of configuration would you like to use?:" 20 75 4 \
 	"BASIC" "Install NSM components with recommended settings" ON \
@@ -704,8 +902,10 @@ whiptail_sensor_config() {

 whiptail_set_hostname() {

+	[ -n "$TESTING" ] && return
+
 	HOSTNAME=$(whiptail --title "Security Onion Setup" --inputbox \
-  "Enter the Hostname you would like to set." 10 75 $HOSTNAME 3>&1 1>&2 2>&3)
+	"Enter the Hostname you would like to set." 10 75 "$HOSTNAME" 3>&1 1>&2 2>&3)

 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
@@ -713,7 +913,7 @@ whiptail_set_hostname() {
 	while [[ "$HOSTNAME" == *'localhost'* ]] ; do
 		whiptail --title "Security Onion Setup" --msgbox "Please choose a hostname that doesn't contain localhost." 8 75
 		HOSTNAME=$(whiptail --title "Security Onion Setup" --inputbox \
-    "Enter the Hostname you would like to set." 10 75 $HOSTNAME 3>&1 1>&2 2>&3)
+		"Enter the Hostname you would like to set." 10 75 "$HOSTNAME" 3>&1 1>&2 2>&3)
 		local exitstatus=$?
 		whiptail_check_exitstatus $exitstatus
 	done
@@ -721,43 +921,58 @@ whiptail_set_hostname() {
 }

 whiptail_set_redirect() {
+
+	[ -n "$TESTING" ] && return
+
 	REDIRECTINFO=$(whiptail --title "Security Onion Setup" --radiolist \
 	"Choose the access method for the web interface:" 20 75 4 \
 	"IP" "Use IP to access the web interface" ON  \
-  "HOSTNAME" "Use Hostname ($HOSTNAME) to access the web interface" OFF \
+	"HOSTNAME" "Use hostname to access the web interface" OFF \
 	"OTHER" "Use a different name like a FQDN or Load Balancer" OFF 3>&1 1>&2 2>&3 )
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
 }

 whiptail_set_redirect_host() {
+
+	[ -n "$TESTING" ] && return
+
 	REDIRECTHOST=$(whiptail --title "Security Onion Setup" --inputbox \
-    "Enter the Hostname or IP you would like to use for the web interface." 10 75 $HOSTNAME 3>&1 1>&2 2>&3)
+	"Enter the Hostname or IP you would like to use for the web interface." 10 75 "$HOSTNAME" 3>&1 1>&2 2>&3)
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus
 }

 whiptail_set_redirect_info() {
+
+	[ -n "$TESTING" ] && return
+
 	whiptail --title "Security Onion Setup" --msgbox "The following selection refers to accessing the web interface. \n
 For security reasons, we use strict cookie enforcement." 10 75
 }

 whiptail_setup_complete() {

-  whiptail --title "Security Onion Setup" --msgbox "Finished installing this as an $INSTALLTYPE. Press Enter to reboot." 8 75
-  install_cleanup >> $SETUPLOG 2>&1
+	[ -n "$TESTING" ] && return
+
+	whiptail --title "Security Onion Setup" --msgbox "Finished installing this as an $install_type. Press Enter to reboot." 8 75
+	install_cleanup >> $setup_log 2>&1

 }

 whiptail_setup_failed() {

-  whiptail --title "Security Onion Setup" --msgbox "Install had a problem. Please see $SETUPLOG for details. Press Enter to reboot." 8 75
-  install_cleanup >> $SETUPLOG 2>&1
+	[ -n "$TESTING" ] && return
+
+	whiptail --title "Security Onion Setup" --msgbox "Install had a problem. Please see $setup_log for details. Press Enter to reboot." 8 75
+	install_cleanup >> $setup_log 2>&1

 }

 whiptail_shard_count() {

+	[ -n "$TESTING" ] && return
+
 	SHARDCOUNT=$(whiptail --title "Security Onion Setup" --inputbox \
 	"\nEnter ES Shard Count: \n \n(Default value is pre-populated)" 10 75 125 3>&1 1>&2 2>&3)

@@ -768,28 +983,54 @@ whiptail_shard_count() {

 whiptail_suricata_pins() {

-  FILTEREDCORES=$(echo ${LISTCORES[@]} ${BROPINS[@]} | tr -d '"' | tr ' ' '\n' | sort | uniq -u | awk '{print $1 " \"" "core" "\""}')
-  SURIPINS=$(whiptail --noitem --title "Pin Suricata CPUS" --checklist "Please Select $LBPROCS cores to pin Suricata to:" 20 75 12 ${FILTEREDCORES[@]} 3>&1 1>&2 2>&3 )
+	[ -n "$TESTING" ] && return

+	local filtered_core_list
+	readarray -t filtered_core_list <<< "$(echo "${cpu_core_list[@]}" "${BROPINS[@]}" | xargs -n1 | sort | uniq -u | awk '{print $1}')"
+
+	local filtered_core_str=()
+    for item in "${filtered_core_list[@]}"; do
+        filtered_core_str+=("$item" "")
+    done
+
+	SURIPINS=$(whiptail --noitem --title "Pin Suricata CPUS" --checklist "Please select $lb_procs cores to pin Suricata to:" 20 75 12 "${filtered_core_str[@]}" 3>&1 1>&2 2>&3 )
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

+	SURIPINS=$(echo "$SURIPINS" | tr -d '"')
+
+	IFS=' ' read -ra SURIPINS <<< "$SURIPINS"
+
 }

 whiptail_master_updates() {

-  MASTERUPDATES=$(whiptail --title "Security Onion Setup" --radiolist \
+	[ -n "$TESTING" ] && return
+
+	local update_string
+	update_string=$(whiptail --title "Security Onion Setup" --radiolist \
 	"How would you like to download updates for your grid?:" 20 75 4 \
 	"MASTER" "Master node is proxy for OS/Docker updates." ON \
 	"OPEN" "Each node connect to the Internet for updates" OFF 3>&1 1>&2 2>&3 )
-
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus

+	case "$update_string" in
+		'MASTER')
+			MASTERUPDATES='1'
+			;;
+		*)
+			MASTERUPDATES='0'
+			;;
+	esac
+
+
 }

 whiptail_node_updates() {

+	[ -n "$TESTING" ] && return
+
 	NODEUPDATES=$(whiptail --title "Security Onion Setup" --radiolist \
 	"How would you like to download updates for this node?:" 20 75 4 \
 	"MASTER" "Download OS/Docker updates from the Master." ON \
@@ -802,11 +1043,11 @@ whiptail_node_updates() {

 whiptail_you_sure() {

-  echo "whiptail_you_sure called" >> $SETUPLOG 2>&1
+	[ -n "$TESTING" ] && return
+
 	whiptail --title "Security Onion Setup" --yesno "Are you sure you want to install Security Onion over the internet?" 8 75

 	local exitstatus=$?
-  echo "whiptail_you_sure returning $exitstatus" >> $SETUPLOG 2>&1
 	return $exitstatus

 }
--- a/setup/yum_repos/salt-2019-2.repo
+++ b/setup/yum_repos/salt-2019-2.repo
@@ -0,0 +1,6 @@
+[saltstack-repo]
+name=SaltStack repo for RHEL/CentOS $releasever PY3
+baseurl=https://repo.saltstack.com/py3/redhat/$releasever/$basearch/2019.2
+enabled=1
+gpgcheck=1
+gpgkey=https://repo.saltstack.com/py3/redhat/$releasever/$basearch/2019.2/SALTSTACK-GPG-KEY.pub
--- a/setup/yum_repos/salt-latest.repo
+++ b/setup/yum_repos/salt-latest.repo
@@ -0,0 +1,7 @@
+[salt-latest]
+name=SaltStack Latest Release Channel for RHEL/Centos $releasever
+baseurl=https://repo.saltstack.com/py3/redhat/7/$basearch/latest
+failovermethod=priority
+enabled=1
+gpgcheck=1
+gpgkey=https://repo.saltstack.com/py3/redhat/$releasever/$basearch/latest/SALTSTACK-GPG-KEY.pub
--- a/setup/yum_repos/wazuh.repo
+++ b/setup/yum_repos/wazuh.repo
@@ -0,0 +1,7 @@
+[wazuh_repo]
+gpgcheck=1
+gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+enabled=1
+name=Wazuh repository
+baseurl=https://packages.wazuh.com/3.x/yum/
+protect=1
--- a/upgrade/so-update-functions
+++ b/upgrade/so-update-functions
@@ -156,12 +156,12 @@ salt_highstate() {
 update_held_packages() {

    if [ $OS == "centos" ]
-      SALTVER=2019.2.3
+      SALTVER=2019.2.4
      DOCKERVER=
      yum -y --disableexcludes=all update salt-$SALTVER
      yum -y --disableexcludes=all update docker-ce-$DOCKERVER
    else
-      SALTVER=2019.2.3+ds-1
+      SALTVER=2019.2.4+ds-1
      DOCKERVER=5:19.03.8~3-0~ubuntu-xenial
    fi