Firewall Fun

salt/firewall/defaults.yaml

@@ -0,0 +1,89 @@
+firewall:
+  hostgroups:
+    anywhere:
+      ips:
+        delete:
+        insert:
+          - 0.0.0.0/0
+    dockernet:
+      ips:
+        delete:
+        insert:
+          - 172.17.0.0/24
+    localhost:
+      ips:
+        delete:
+        insert:
+          - 127.0.0.1
+    self:
+      ips:
+        delete:
+        insert: []
+    analyst:
+      ips:
+        delete: []
+        insert: [127.0.0.1]
+    beats_endpoint:
+      ips:
+        delete: []
+        insert: [127.0.0.1]
+    beats_endpoint_ssl:
+      ips: 
+        delete: []
+        insert: []
+    elastic_agent_endpoint:
+      ips:
+        delete: []
+        insert: [127.0.0.1]
+    elasticsearch_rest:
+      ips: 
+        delete: []
+        insert: []
+    endgame:
+      ips:
+        delete: []
+        insert: [127.0.0.1]
+    fleet:
+      ips:
+        delete: []
+        insert: []
+    heavy_node:
+      ips:
+        delete: []
+        insert: [] 
+    idh:
+      ips: 
+        delete: []
+        insert: []
+    manager:
+      ips:
+        delete: []
+        insert: [127.0.0.1]
+    minion:
+      ips:
+        delete: []
+        insert: [127.0.0.1]
+    node:
+      ips:
+        delete: []
+        insert: []
+    receiver:
+      ips: 
+        delete: []
+        insert: []
+    search_node:
+      ips:
+        delete: []
+        insert: [127.0.0.1]
+    sensor:
+      ips:
+        delete: []
+        insert: [127.0.0.1]
+    strelka_frontend:
+      ips:
+        delete: []
+        insert: []
+    syslog:
+      ips: 
+        delete: []
+        insert: []

salt/idstools/soc_idstools.yaml

@@ -25,13 +25,16 @@ idstools:
       file: True
       global: True
       advanced: True
+      title: Local Rules
     filters__rules:
       description: You can set custom filters for Suricata when using it for meta data creation.
       file: True
       global: True
       advanced: True
+      title: Filter Rules
     extraction__rules:
       description: This is a list of mime types for file extraction when Suricata is used for meta data creation.
       file: True
       global: True
-      advanced: True
+      advanced: True
+      title: Extraction Rules