From e3c8018824d1c7a7d7378b26f3de89d3c4c0ccdd Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 15 Dec 2020 16:44:47 -0500
Subject: [PATCH] Toggle strelka rules after the user is prompted it strelka
 should be installed to ensure strelka rules are updated later during the
 setup process

---
 setup/so-setup | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/setup/so-setup b/setup/so-setup
index 70df60feb..3c59c59cb 100755
--- a/setup/so-setup
+++ b/setup/so-setup
@@ -406,13 +406,6 @@ if [[ $is_manager && ! $is_eval ]]; then
 		whiptail_oinkcode
 	fi
 
-	if [[ "$STRELKA" = 1 ]]; then
-		info "Enabling Strelka rules"
-		STRELKARULES=1
-	else
-		info "Disabling Strelka rules: STRELKA='$STRELKA'"
-	fi
-
 	if [ "$MANAGERADV" = 'ADVANCED' ] && [ "$ZEEKVERSION" != 'SURICATA' ]; then
 		whiptail_manager_adv_service_zeeklogs
 	fi
@@ -421,6 +414,14 @@ fi
 if [[ $is_manager ]]; then
 	whiptail_components_adv_warning
 	whiptail_enable_components
+
+	if [[ "$STRELKA" = 1 ]]; then
+		info "Enabling Strelka rules"
+		STRELKARULES=1
+	else
+		info "Disabling Strelka rules: STRELKA='$STRELKA'"
+	fi
+
 	whiptail_dockernet_check
 fi