mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-10 11:12:51 +01:00
Compare commits
2 Commits
TOoSmOotH-
...
idstools-r
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
e105bd12e6 | ||
|
|
72a4ba405f |
@@ -70,7 +70,7 @@
|
||||
|
||||
{# Define the Detections custom ruleset that should always be present #}
|
||||
{% set CUSTOM_RULESET = {
|
||||
'name': 'custom',
|
||||
'name': '__custom__',
|
||||
'description': 'User-created custom rules created via the Detections module in the SOC UI',
|
||||
'sourceType': 'elasticsearch',
|
||||
'sourcePath': 'so_detection.ruleset:__custom__',
|
||||
@@ -83,7 +83,7 @@
|
||||
{# Always append the custom ruleset to suricataengine.rulesetSources if not already present #}
|
||||
{% if SOCMERGED.config.server.modules.suricataengine is defined and SOCMERGED.config.server.modules.suricataengine.rulesetSources is defined %}
|
||||
{% if SOCMERGED.config.server.modules.suricataengine.rulesetSources is not mapping %}
|
||||
{% set custom_names = SOCMERGED.config.server.modules.suricataengine.rulesetSources | selectattr('name', 'equalto', 'custom') | list %}
|
||||
{% set custom_names = SOCMERGED.config.server.modules.suricataengine.rulesetSources | selectattr('name', 'equalto', '__custom__') | list %}
|
||||
{% if custom_names | length == 0 %}
|
||||
{% do SOCMERGED.config.server.modules.suricataengine.rulesetSources.append(CUSTOM_RULESET) %}
|
||||
{% endif %}
|
||||
|
||||
Reference in New Issue
Block a user