diff --git a/salt/suricata/enabled.sls b/salt/suricata/enabled.sls index 3e015d100..b148e952a 100644 --- a/salt/suricata/enabled.sls +++ b/salt/suricata/enabled.sls @@ -57,7 +57,6 @@ so-suricata: - watch: - file: suriconfig - file: surithresholding - - file: /opt/so/conf/suricata/rules/ - file: /opt/so/conf/suricata/bpf - file: suriclassifications - require: @@ -66,6 +65,12 @@ so-suricata: - file: suribpf - file: suriclassifications +surirulereload: + cmd.run: + - name: /usr/sbin/so-suricata-reload-rules + - watch: + - onchanges: surirulesync + delete_so-suricata_so-status.disabled: file.uncomment: - name: /opt/so/conf/so-status/so-status.conf diff --git a/salt/suricata/tools/sbin/so-suricata-reload-rules b/salt/suricata/tools/sbin/so-suricata-reload-rules new file mode 100644 index 000000000..05301a4fc --- /dev/null +++ b/salt/suricata/tools/sbin/so-suricata-reload-rules @@ -0,0 +1,12 @@ +#!/bin/bash +# +# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one +# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at +# https://securityonion.net/license; you may not use this file except in compliance with the +# Elastic License 2.0. + + + +. /usr/sbin/so-common + +docker exec -it so-suricata /opt/suricata/bin/suricatasc -c reload-rules /var/run/suricata/suricata-command.socket >> /opt/so/log/suricata/reload.log 2>&1 \ No newline at end of file