CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-09 02:32:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/2.4/dev' into vlb2

Browse Source
This commit is contained in:
Josh Patterson
2025-09-25 16:06:36 -04:00
parent 1fb558cc77 7f1b76912c
commit cd04d1e5a7
3 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-setup
View File

@@ -79,7 +79,7 @@ if DEFAULTPOLICY=$(fleet_api "outputs/fleet-default-output"); then
fleet_default=$(echo "$DEFAULTPOLICY" | jq -er '.item.is_default') fleet_default=$(echo "$DEFAULTPOLICY" | jq -er '.item.is_default')
fleet_default_monitoring=$(echo "$DEFAULTPOLICY" | jq -er '.item.is_default_monitoring') fleet_default_monitoring=$(echo "$DEFAULTPOLICY" | jq -er '.item.is_default_monitoring')
# Check that fleet-default-output isn't configured as a default for anything ( both variables return false ) # Check that fleet-default-output isn't configured as a default for anything ( both variables return false )
if [[ $fleet_default ]] && [[ $fleet_default_monitoring ]]; then if [[ ! $fleet_default ]] && [[ ! $fleet_default_monitoring ]]; then
echo -e "\nso-manager_elasticsearch is configured as the current default policy..." echo -e "\nso-manager_elasticsearch is configured as the current default policy..."
else else
echo -e "\nVerification of so-manager_elasticsearch policy failed... The default 'fleet-default-output' output is still active..." echo -e "\nVerification of so-manager_elasticsearch policy failed... The default 'fleet-default-output' output is still active..."

3
salt/kratos/enabled.sls
View File

@@ -54,6 +54,9 @@ so-kratos:
- file: kratosconfig - file: kratosconfig
- file: kratoslogdir - file: kratoslogdir
- file: kratosdir - file: kratosdir
- retry:
attempts: 10
interval: 10
delete_so-kratos_so-status.disabled: delete_so-kratos_so-status.disabled:
file.uncomment: file.uncomment:

2
salt/soc/defaults.yaml
View File

@@ -2545,7 +2545,7 @@ soc:
level: 'high' # info | low | medium | high | critical level: 'high' # info | low | medium | high | critical
assistant: assistant:
enabled: false enabled: false
investigationPrompt: Investigate Alert ID {socid} investigationPrompt: Investigate Alert ID {socId}
contextLimitSmall: 200000 contextLimitSmall: 200000
contextLimitLarge: 1000000 contextLimitLarge: 1000000
thresholdColorRatioLow: 0.5 thresholdColorRatioLow: 0.5