Merge pull request #2428 from Security-Onion-Solutions/feature/strelka_pillar_repos

Support setting rule repos via pillar

salt/common/tools/sbin/so-yara-update

@@ -20,6 +20,7 @@ echo "Starting to check for yara rule updates at $(date)..."
 
 output_dir="/opt/so/saltstack/default/salt/strelka/rules"
 mkdir -p $output_dir
+
 repos="$output_dir/repos.txt"
 ignorefile="$output_dir/ignore.txt"
 
@@ -95,7 +96,7 @@ clone_dir="/tmp"
 if [ "$gh_status" == "200" ]  || [ "$gh_status" == "301" ]; then
 
   while IFS= read -r repo; do
-
+    if ! $(echo "$repo" | grep -qE '^#'); then
       # Remove old repo if existing bc of previous error condition or unexpected disruption
       repo_name=`echo $repo | awk -F '/' '{print $NF}'`
       [ -d $repo_name ] && rm -rf $repo_name
@@ -144,6 +145,7 @@ if [ "$gh_status" == "200" ]  || [ "$gh_status" == "301" ]; then
           fi
       done
       rm -rf $clone_dir/$repo_name
+  fi
   done < $repos
 
   echo "Done!"

salt/strelka/init.sls

@@ -56,6 +56,12 @@ strelkarules:
     - user: 939
     - group: 939
 
+strelkarepos:
+  file.managed:
+    - name: /opt/so/saltstack/default/salt/strelka/rules/repos.txt
+    - source: salt://strelka/rules/repos.txt.jinja
+    - template: jinja
+    
 {%- endif %}
 
 strelkadatadir:

salt/strelka/rules/repos.txt.jinja

@@ -0,0 +1,4 @@
+# DO NOT EDIT THIS FILE! Strelka YARA rule repos are stored here from the strelka.repos pillar section
+{%- for repo in salt['pillar.get']('strelka:repos', {}) %}
+{{ repo }}
+{%- endfor %}

setup/so-functions

@@ -1260,6 +1260,8 @@ manager_global() {
 		"strelka:"\
 		"  enabled: $STRELKA"\
 		"  rules: 1"\
+		"  repos:"\
+		"    - https://github.com/Neo23x0/signature-base"\
 		"curator:"\
 		"  hot_warm: False"\
 		"elastic:"\