Files
securityonion/salt/idstools/etc/rulecat.conf
Mike Reeves 1d24d7bc7f Misc pillars
2020-07-17 17:38:10 -04:00

19 lines
708 B
Plaintext

{% set URLS = salt['pillar.get']('idstools:config:urls', {}) -%}
{% set RULESET = salt['pillar.get']('idstools:config:ruleset') -%}
{% set OINKCODE = salt['pillar.get']('idstools:config:oinkcode') -%}
--suricata-version=5.0
--merged=/opt/so/rules/nids/all.rules
--local=/opt/so/rules/nids/local.rules
--disable=/opt/so/idstools/etc/disable.conf
--enable=/opt/so/idstools/etc/enable.conf
--modify=/opt/so/idstools/etc/modify.conf
{%- if RULESET == 'ETOPEN' %}
--etopen
{%- elif RULESET == 'ETPRO' %}
--etpro={{ OINKCODE }}
{%- elif RULESET == 'TALOS' %}
--url=https://www.snort.org/rules/snortrules-snapshot-2983.tar.gz?oinkcode={{ OINKCODE }}
{%- endif %}
{%- for URL in URLS %}
--url={{ URL }}
{%- endfor %}