diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index b63094927..e11c5ad73 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -248,7 +248,7 @@ soc: global: True advanced: True customRulesets: - description: 'Custom URLs or local files to sync Suricata rules from. Format is: {"community":true,"ruleset":"snort-community","license":"GPLv2","path":"https://www.snort.org/downloads/community/snort3-community-rules.tar.gz"}. All fields are required. Replace the URL in path with a full file path for local rules, which must be put under: /nsm/rules/detect-suricata/custom_file. "community" disables some management options for the imported rules - they can''t be deleted or edited, just tuned, duplicated, and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by navigating to Detections --> Options dropdown menu --> Suricata --> Full Update.' + description: 'Custom URLs or local files to sync Suricata rules from. Format is: {"community":true,"license":"GPLv2","ruleset":"snort-community","url":"https://www.snort.org/downloads/community/snort3-community-rules.tar.gz"}. All fields are required. Replace the url parameter with "file" and the path for local rules, which must be put under: /nsm/rules/detect-suricata/custom_file. "community" disables some management options for the imported rules - they can''t be deleted or edited, just tuned, duplicated, and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by navigating to Detections --> Options dropdown menu --> Suricata --> Full Update.' global: True multiline: True advanced: True