securityonion/salt/sensoroni/files/sensoroni.json

{%  from 'vars/globals.map.jinja' import GLOBALS %}
{%- from 'sensoroni/map.jinja' import SENSORONIMERGED -%}
{
  "logFilename": "/opt/sensoroni/logs/sensoroni.log",
  "logLevel":"info",
  "agent": {
    "nodeId": "{{ GLOBALS.hostname | lower }}",
    "role": "{{ GLOBALS.role }}",
    "description": {{ SENSORONIMERGED.config.node_description | tojson }},
    "address": "{{ GLOBALS.node_ip }}",
    "model": "{{ GLOBALS.so_model }}",
    "pollIntervalMs": {{ SENSORONIMERGED.config.node_checkin_interval_ms }},
    "serverUrl": "https://{{ GLOBALS.url_base }}/sensoroniagents",
    "verifyCert": false,
    "modules": {
{%- if SENSORONIMERGED.config.analyze.enabled %} 
      "analyze": {
        "timeoutMs": {{ SENSORONIMERGED.config.analyze.timeout_ms }},
        "parallelLimit": {{ SENSORONIMERGED.config.analyze.parallel_limit }}
      },
{%- endif %}
      "importer": {},
      "statickeyauth": {
        "apiKey": "{{ GLOBALS.sensoroni_key }}"
{%  if GLOBALS.is_sensor %}
{%    from 'pcap/config.map.jinja' import PCAPMERGED %}
{%    from 'suricata/map.jinja' import SURICATAMERGED %}
{#    if PCAPMERGED.enabled is true then we know that steno is the pcap engine #}
{#    if it is false, then user has steno disabled in ui or has selected suricata for pcap engine #}
{%-   if PCAPMERGED.enabled %}
      },     
      "stenoquery": {
        "executablePath": "/opt/sensoroni/scripts/stenoquery.sh",
        "pcapInputPath": "/nsm/pcap",
        "pcapOutputPath": "/nsm/pcapout"
      }
{%-   elif GLOBALS.pcap_engine == "SURICATA" and SURICATAMERGED.enabled %}
      },     
      "suriquery": {
        "executablePath": "/opt/sensoroni/scripts/suriquery.sh",
        "pcapInputPath": "/nsm/suripcap",
        "pcapOutputPath": "/nsm/pcapout"
      }
{%-   else %}
      }
{%   endif %}
{%- endif %}
    }
  }
}