securityonion/salt/sensoroni/files/sensoroni.json

{%- set URLBASE = salt['pillar.get']('global:url_base') %}
{%- set DESCRIPTION = salt['pillar.get']('sensoroni:node_description', '') %}
{%- set MODEL = salt['grains.get']('sosmodel', '') %}
{%- set ADDRESS = salt['pillar.get']('sensoroni:node_address') %}
{%- set ANALYZE_TIMEOUT_MS = salt['pillar.get']('sensoroni:analyze_timeout_ms', 900000) %}
{%- set ANALYZE_PARALLEL_LIMIT = salt['pillar.get']('sensoroni:analyze_parallel_limit', 5) %}
{%- set SENSORONIKEY = salt['pillar.get']('global:sensoronikey', '') %}
{%- set CHECKININTERVALMS = salt['pillar.get']('sensoroni:node_checkin_interval_ms', 10000) %}
{%- set ROLE = grains.id.split('_') | last %}
{%- if ROLE in ['eval', 'standalone', 'sensor', 'heavynode'] %}
{%-   set STENODEFAULT = True %}
{%- else %}
{%-   set STENODEFAULT = False %}
{%- endif %}
{%- set STENOENABLED = salt['pillar.get']('steno:enabled', STENODEFAULT) %}
{
  "logFilename": "/opt/sensoroni/logs/sensoroni.log",
  "logLevel":"info",
  "agent": {
    "nodeId": "{{ grains.host | lower }}",
    "role": "{{ grains.role }}",
    "description": {{ DESCRIPTION | tojson }},
    "address": "{{ ADDRESS }}",
    "model": "{{ MODEL }}",
    "pollIntervalMs": {{ CHECKININTERVALMS if CHECKININTERVALMS else 10000 }},
    "serverUrl": "https://{{ URLBASE }}/sensoroniagents",
    "verifyCert": false,
    "modules": {
      "analyze": {
        "timeoutMs": {{ ANALYZE_TIMEOUT_MS }},
        "parallelLimit": {{ ANALYZE_PARALLEL_LIMIT }}
      },
      "importer": {},
      "statickeyauth": {
        "apiKey": "{{ SENSORONIKEY }}"
{%- if STENOENABLED %} 
      },     
      "stenoquery": {
        "executablePath": "/opt/sensoroni/scripts/stenoquery.sh",
        "pcapInputPath": "/nsm/pcap",
        "pcapOutputPath": "/nsm/pcapout"
      }
{%- else %}
      }
{%- endif %}
    }
  }
}