Added new soc-related saltstack files.

salt/soc/files/soc/changes.json

@@ -0,0 +1,23 @@
+{
+  "title": "Introducing Hybrid Hunter 1.2.1 Beta",
+  "changes": [
+    { "summary": "New authentication framework" },
+    { "summary": "New Logstash pipeline setup. Now uses multiple pipelines." },
+    { "summary": "New Master + Search node type and well as a Heavy Node type in the install." },
+    { "summary": "Change all nodes to point to the docker registry on the Master. This cuts down on the calls to dockerhub." },
+    { "summary": "Upgraded to Zeek 3.0" },
+    { "summary": "Upgraded to Elastic 7.6" },
+    { "summary": "New SO Start | Stop | Restart scripts for all components (eg. `so-playbook-restart`)." },
+    { "summary": "BPF support for Suricata (NIDS), Steno (PCAP) & Zeek (<a target='new' href='https://github.com/Security-Onion-Solutions/securityonion-saltstack/wiki/BPF'>More Info</a>)." },
+    { "summary": "Updated Domain Stats & Frequency Server containers to Python3 & created new Salt states for them." },
+    { "summary": "Added so-status script which gives an easy to read look at container status." },
+    { "summary": "Manage threshold.conf for Suricata using the thresholding pillar." },
+    { "summary": "The ISO now includes all the docker containers for faster install speeds." },
+    { "summary": "You now set the password for the onion account during the iso install. This account is temporary and will be removed after so-setup." },
+    { "summary": "Updated Helix parsers for better compatibility." },
+    { "summary": "Updated telegraf docker to include curl and jq." },
+    { "summary": "CVE-2020-0601 Zeek Detection Script." },
+    { "summary": "ISO Install now prompts you to create a password for the onion user during imaging. This account gets disabled during setup." },
+    { "summary": "Check out the Hybrid Hunter Quick Start Guide." }
+  ]
+}

salt/soc/files/soc/soc.json

@@ -0,0 +1,26 @@
+{%- set MASTERIP = salt['pillar.get']('static:masterip', '') -%}
+{%- set SENSORONIKEY = salt['pillar.get']('static:sensoronikey', '') -%}
+{
+  "logFilename": "/opt/sensoroni/logs/sensoroni-server.log",
+  "server": {
+    "bindAddress": "0.0.0.0:9822",
+    "baseUrl": "/",
+    "maxPacketCount": 5000,
+    "htmlDir": "html",
+    "modules": {
+      "filedatastore": {
+        "jobDir": "jobs"
+      },
+      "securityonion": {
+        "elasticsearchHost": "http://{{ MASTERIP }}:9200",
+        "elasticsearchUsername": "",
+        "elasticsearchPassword": "",
+        "elasticsearchVerifyCert": false
+      },
+      "statickeyauth": {
+        "anonymousCidr": "172.17.0.0/24",
+        "apiKey": "{{ SENSORONIKEY }}"
+      }
+    }
+  }
+}