mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-07-23 01:05:40 +02:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
334978ad92 |
@@ -1998,11 +1998,11 @@ main() {
|
||||
# Testing that salt-master is up by checking that is it connected to itself
|
||||
check_saltmaster_status
|
||||
|
||||
# update the salt-master and salt-minion configs here and start the minion
|
||||
# update the salt-minion configs here and start the minion
|
||||
# since highstate are disabled above, minion start should not trigger a highstate
|
||||
echo ""
|
||||
echo "Ensuring salt-master and salt-minion configs are up-to-date."
|
||||
salt-call state.apply salt.master -l info queue=True
|
||||
echo "Ensuring salt-minion configs are up-to-date."
|
||||
salt-call state.apply salt.minion -l info queue=True
|
||||
echo ""
|
||||
|
||||
# ensure the mine is updated and populated before highstates run, following the salt-master restart
|
||||
|
||||
@@ -94,9 +94,7 @@ salt_master_service:
|
||||
- file: checkmine_engine
|
||||
- file: pillarWatch_engine
|
||||
- file: engines_config
|
||||
- require:
|
||||
- cmd: wait_for_salt_minion_ready
|
||||
- order: last
|
||||
- order: 9002
|
||||
|
||||
{% else %}
|
||||
|
||||
|
||||
@@ -1532,7 +1532,7 @@ soc:
|
||||
agentMapping:
|
||||
Orchestrator: Claude Sonnet
|
||||
Investigator: Claude Sonnet
|
||||
Detection Engineer: Claude Sonnet
|
||||
DetectionEngineer: Claude Sonnet
|
||||
onionconfig:
|
||||
saltstackDir: /opt/so/saltstack
|
||||
bypassEnabled: false
|
||||
|
||||
@@ -786,7 +786,7 @@ soc:
|
||||
Investigator:
|
||||
description: This agent investigates alerts, explains events and records, and hunts through event data. It can also acknowledge alerts and escalate to cases.
|
||||
global: True
|
||||
Detection Engineer:
|
||||
DetectionEngineer:
|
||||
description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
|
||||
global: True
|
||||
client:
|
||||
|
||||
Reference in New Issue
Block a user