CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7226 from Security-Onion-Solutions/zeekhn

Browse Source 
Add Zeek Homenet in networks.cfg
This commit is contained in:
Mike Reeves
2022-02-18 11:11:56 -05:00
committed by GitHub
parent becdc34677 95eab61615
commit e4148818d8
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
salt/zeek/files/networks.cfg.jinja Normal file
View File

@@ -0,0 +1,9 @@
{%- if salt['pillar.get']('sensor:hnsensor') %}
{%- set HOME_NET = salt['pillar.get']('sensor:hnsensor') %}
{%- else %}
{%- set HOME_NET = salt['pillar.get']('global:hnmanager') %}
{%- endif %}
{%- set HNLIST = HOME_NET.split(',')}
{%- for HN in HNLIST %}
{{ HN }}
{%- endfor %}S

10
salt/zeek/init.sls
View File

@@ -127,6 +127,14 @@ nodecfg:
- group: 939 - group: 939
- template: jinja - template: jinja
networkscfg:
file.managed:
- name: /opt/so/conf/zeek/networks.cfg
- source: salt://zeek/files/networks.cfg.jinja
- user: 937
- group: 939
- template: jinja
#zeekcleanscript: #zeekcleanscript:
# file.managed: # file.managed:
# - name: /usr/local/bin/zeek_clean # - name: /usr/local/bin/zeek_clean
@@ -209,6 +217,7 @@ so-zeek:
- /nsm/zeek/extracted:/nsm/zeek/extracted:rw - /nsm/zeek/extracted:/nsm/zeek/extracted:rw
- /opt/so/conf/zeek/local.zeek:/opt/zeek/share/zeek/site/local.zeek:ro - /opt/so/conf/zeek/local.zeek:/opt/zeek/share/zeek/site/local.zeek:ro
- /opt/so/conf/zeek/node.cfg:/opt/zeek/etc/node.cfg:ro - /opt/so/conf/zeek/node.cfg:/opt/zeek/etc/node.cfg:ro
- /opt/so/conf/zeek/networks.cfg:/opt/zeek/etc/networks.cfg:ro
- /opt/so/conf/zeek/zeekctl.cfg:/opt/zeek/etc/zeekctl.cfg:ro - /opt/so/conf/zeek/zeekctl.cfg:/opt/zeek/etc/zeekctl.cfg:ro
- /opt/so/conf/zeek/policy/securityonion:/opt/zeek/share/zeek/policy/securityonion:ro - /opt/so/conf/zeek/policy/securityonion:/opt/zeek/share/zeek/policy/securityonion:ro
- /opt/so/conf/zeek/policy/custom:/opt/zeek/share/zeek/policy/custom:ro - /opt/so/conf/zeek/policy/custom:/opt/zeek/share/zeek/policy/custom:ro
@@ -219,6 +228,7 @@ so-zeek:
- watch: - watch:
- file: /opt/so/conf/zeek/local.zeek - file: /opt/so/conf/zeek/local.zeek
- file: /opt/so/conf/zeek/node.cfg - file: /opt/so/conf/zeek/node.cfg
- file: /opt/so/conf/zeek/networks.cfg
- file: /opt/so/conf/zeek/zeekctl.cfg - file: /opt/so/conf/zeek/zeekctl.cfg
- file: /opt/so/conf/zeek/policy - file: /opt/so/conf/zeek/policy
- file: /opt/so/conf/zeek/bpf - file: /opt/so/conf/zeek/bpf