Add support to relaod rules instead of restart

salt/suricata/enabled.sls

@@ -57,7 +57,6 @@ so-suricata:
     - watch:
       - file: suriconfig
       - file: surithresholding
-      - file: /opt/so/conf/suricata/rules/
       - file: /opt/so/conf/suricata/bpf
       - file: suriclassifications
     - require:
@@ -66,6 +65,12 @@ so-suricata:
       - file: suribpf
       - file: suriclassifications
 
+surirulereload:
+  cmd.run: 
+    - name: /usr/sbin/so-suricata-reload-rules
+    - watch: 
+      - onchanges: surirulesync
+    
 delete_so-suricata_so-status.disabled:
   file.uncomment:
     - name: /opt/so/conf/so-status/so-status.conf

salt/suricata/tools/sbin/so-suricata-reload-rules

@@ -0,0 +1,12 @@
+#!/bin/bash
+#
+# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
+# https://securityonion.net/license; you may not use this file except in compliance with the
+# Elastic License 2.0.
+
+
+
+. /usr/sbin/so-common
+
+docker exec -it so-suricata /opt/suricata/bin/suricatasc -c reload-rules /var/run/suricata/suricata-command.socket >> /opt/so/log/suricata/reload.log 2>&1