mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-08-16 12:42:27 +02:00
Josh Patterson
2663ca87a2
MailTo, MailConnectionSummary and MailHostUpDown do nothing but send mail, and the Zeek container has no mail program, so nothing they control can happen. Mark them read only rather than offering knobs in SOC that cannot take effect. MailConnectionSummary only gates the emailed copy; the connection summary is generated and archived either way. MailTo also feeds Notice::mail_dest, but Security Onion never enables the notice email action, so that half is inert too. MailHostUpDown gates only the notification text - host status detection, the plugin hook and the stored state all run regardless. MinDiskSpace stays editable. It is not mail only: setting it to 0 skips the disk space check entirely, and the warning it produces is not emailed but does appear in the output of "zeekctl cron". Correct its description, and MailHostUpDown's, which both claimed these settings have no visible effect.