Merge pull request #14949 from Security-Onion-Solutions/reyesj2-patch-7

update pcap permissions when no stenographer user exists
This commit is contained in:
Jorge Reyes
2025-08-21 08:33:30 -05:00
committed by GitHub

View File

@@ -23,7 +23,7 @@ include:
# /nsm/pcap is empty until stenographer is used as pcap engine
{% set pcap_id = 941 %}
{% set user_list = salt['user.list_users']() %}
{% if 'stenographer' not in user_list %}
{% if GLOBALS.pcap_engine == "SURICATA" and 'stenographer' not in user_list %}
{% set pcap_id = 939 %}
{% endif %}
pcapdir: