From d2fb067110facbac8bcb228e2bc99cdd6650c690 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Wed, 20 Mar 2024 15:57:32 -0400 Subject: [PATCH] FIX: Annotations for BPF and Suricata PCAP #12626 --- salt/suricata/soc_suricata.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/salt/suricata/soc_suricata.yaml b/salt/suricata/soc_suricata.yaml index 7decaa6d3..34c9b6269 100644 --- a/salt/suricata/soc_suricata.yaml +++ b/salt/suricata/soc_suricata.yaml @@ -21,12 +21,12 @@ suricata: helpLink: suricata.html pcap: filesize: - description: Max file size for individual PCAP files written by Suricata. Increasing this number could improve write performance at the expense of pcap retrieval times. + description: Maximum file size for individual PCAP files written by Suricata. Increasing this number could improve write performance at the expense of pcap retrieval time. advanced: True - helplink: suricata.html + helpLink: suricata.html maxsize: - description: Size in GB for total usage size of PCAP on disk. - helplink: suricata.html + description: Maximum disk usage in GB for all PCAP written by Suricata. + helpLink: suricata.html compression: description: Enable compression of Suricata PCAP. advanced: True @@ -36,7 +36,7 @@ suricata: advanced: True helpLink: suricata.html lz4-level: - description: lz4 compression level of PCAP. 0 for no compression 16 for max compression. + description: lz4 compression level of PCAP. 0 for no compression. 16 for maximum compression. advanced: True helpLink: suricata.html filename: @@ -50,13 +50,13 @@ suricata: readonly: True helpLink: suricata.html use-stream-depth: - description: Set to "no" to ignore the stream depth and capture the entire flow. Set this to "yes" to truncate the flow based on the stream depth. + description: Set to "no" to ignore the stream depth and capture the entire flow. Set to "yes" to truncate the flow based on the stream depth. advanced: True regex: ^(yes|no)$ regexFailureMessage: You must enter either yes or no. helpLink: suricata.html conditional: - description: Set to "all" to capture PCAP for all flows. Set to "alerts" to capture PCAP just for alerts or set to "tag" to capture PCAP for just tagged rules. + description: Set to "all" to record PCAP for all flows. Set to "alerts" to record PCAP just for alerts. Set to "tag" to record PCAP for just tagged rules. regex: ^(all|alerts|tag)$ regexFailureMessage: You must enter either all, alert or tag. helpLink: suricata.html