CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

FIX: Annotations for BPF and Suricata PCAP #12626

Browse Source
This commit is contained in:
Doug Burks
2024-03-20 16:06:25 -04:00
committed by GitHub
parent fff4d20e39
commit f3b921342e
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
salt/suricata/soc_suricata.yaml
View File

@@ -25,10 +25,10 @@ suricata:
advanced: True advanced: True
helpLink: suricata.html helpLink: suricata.html
maxsize: maxsize:
description: Maximum size in GB for total disk usage of all PCAP written by Suricata. description: Maximum size in GB for total disk usage of all PCAP files written by Suricata.
helpLink: suricata.html helpLink: suricata.html
compression: compression:
description: Enable compression of Suricata PCAP. description: Enable compression of Suricata PCAP files.
advanced: True advanced: True
helpLink: suricata.html helpLink: suricata.html
lz4-checksum: lz4-checksum:
@@ -36,11 +36,11 @@ suricata:
advanced: True advanced: True
helpLink: suricata.html helpLink: suricata.html
lz4-level: lz4-level:
description: lz4 compression level of PCAP. Set to 0 for no compression. Set to 16 for maximum compression. description: lz4 compression level of PCAP files. Set to 0 for no compression. Set to 16 for maximum compression.
advanced: True advanced: True
helpLink: suricata.html helpLink: suricata.html
filename: filename:
description: Filename output for Suricata PCAP. description: Filename output for Suricata PCAP files.
advanced: True advanced: True
readonly: True readonly: True
helpLink: suricata.html helpLink: suricata.html
@@ -56,7 +56,7 @@ suricata:
regexFailureMessage: You must enter either yes or no. regexFailureMessage: You must enter either yes or no.
helpLink: suricata.html helpLink: suricata.html
conditional: conditional:
description: Set to "all" to record PCAP for all flows. Set to "alerts" to record PCAP just for alerts. Set to "tag" to record PCAP for just tagged rules. description: Set to "all" to record PCAP for all flows. Set to "alerts" to only record PCAP for Suricata alerts. Set to "tag" to only record PCAP for tagged rules.
regex: ^(all|alerts|tag)$ regex: ^(all|alerts|tag)$
regexFailureMessage: You must enter either all, alert or tag. regexFailureMessage: You must enter either all, alert or tag.
helpLink: suricata.html helpLink: suricata.html