CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-05-11 05:40:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add fileanalyze module salt configuration

Browse Source 
Adds sensoroni agent configuration for the new fileanalyze module
that replaces the Strelka file analysis containers:
- defaults.yaml: default config values (watchDirs, concurrency, dedup, etc.)
- sensoroni.json: Jinja2 template to render module config when enabled
- soc_sensoroni.yaml: SOC config schema with descriptions for all settings
This commit is contained in:
Mike Reeves
2026-04-06 14:12:48 -04:00
parent 88de246ce3
commit c6c538363d
3 changed files with 87 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/sensoroni/files/sensoroni.json
+18 -2
View File
@@ -14,7 +14,7 @@
"serverUrl": "https://{{ GLOBALS.url_base }}/sensoroniagents",
"verifyCert": false,
"modules": {
{%- if SENSORONIMERGED.config.analyze.enabled %}
{%- if SENSORONIMERGED.config.analyze.enabled %}
"analyze": {
"timeoutMs": {{ SENSORONIMERGED.config.analyze.timeout_ms }},
"parallelLimit": {{ SENSORONIMERGED.config.analyze.parallel_limit }}
@@ -31,11 +31,27 @@
"statickeyauth": {
"apiKey": "{{ GLOBALS.sensoroni_key }}"
{% if GLOBALS.is_sensor %}
},
},
"suriquery": {
"pcapInputPath": "/nsm/suripcap",
"pcapOutputPath": "/nsm/pcapout",
"pcapMaxCount": {{ SENSORONIMERGED.config.suripcap.pcapMaxCount }}
{%- endif %}
{%- if SENSORONIMERGED.config.fileanalyze.enabled %}
},
"fileanalyze": {
"watchDirs": {{ SENSORONIMERGED.config.fileanalyze.watchDirs | tojson }},
"processedDir": "{{ SENSORONIMERGED.config.fileanalyze.processedDir }}",
"historyDir": "{{ SENSORONIMERGED.config.fileanalyze.historyDir }}",
"logFile": "{{ SENSORONIMERGED.config.fileanalyze.logFile }}",
"concurrency": {{ SENSORONIMERGED.config.fileanalyze.concurrency }},
"maxDepth": {{ SENSORONIMERGED.config.fileanalyze.maxDepth }},
"recycleSeconds": {{ SENSORONIMERGED.config.fileanalyze.recycleSeconds }},
"dedupMaxEntries": {{ SENSORONIMERGED.config.fileanalyze.dedupMaxEntries }},
"dedupTTLSeconds": {{ SENSORONIMERGED.config.fileanalyze.dedupTTLSeconds }},
"yaraRulesPath": "{{ SENSORONIMERGED.config.fileanalyze.yaraRulesPath }}",
"passwordsPath": "{{ SENSORONIMERGED.config.fileanalyze.passwordsPath }}",
"scannerTimeout": {{ SENSORONIMERGED.config.fileanalyze.scannerTimeout }}
{%- endif %}
}
}