securityonion/salt/firewall/soc_firewall.yaml

firewall:
  hostgroups:
    analyst_workstations:
      description: List of IP Addresses or CIDR blocks to allow analyst workstations.
      file: True
      global: True
      title: Analyst Workstations
    analyst: 
      description: List of IP Addresses or CIDR blocks to allow analyst connections.
      file: True
      global: True
      title: Analysts
    standalone: 
      description: List of IP Addresses or CIDR blocks to allow standalone connections.
      file: True
      global: True
      title: Standalone
      advanced: True
    eval: 
      description: List of IP Addresses or CIDR blocks to allow eval connections.
      file: True
      global: True
      title: Eval
      advanced: True
    idh: 
      description: List of IP Addresses or CIDR blocks to allow idh connections.
      file: True
      global: True
      title: IDH Nodes
    manager: 
      description: List of IP Addresses or CIDR blocks to allow manager connections.
      file: True
      global: True
      title: Manager
      advanced: True
    heavynodes: 
      description: List of IP Addresses or CIDR blocks to allow heavynode connections.
      file: True
      global: True
      title: Heavy Nodes
    searchnodes: 
      description: List of IP Addresses or CIDR blocks to allow searchnode connections.
      file: True
      global: True
      title: Searchnodes
    receivers: 
      description: List of IP Addresses or CIDR blocks to allow receiver connections.
      file: True
      global: True
      title: Receivers
  portgroups:
    analyst:
      description: List of ports for use with Analyst connections.
      file: True
      global: True
      title: Analyst Ports
    analyst_workstations:
      description: List of ports for use with analyst workstations.
      file: True
      global: True
      title: Analyst Workstation Ports
    standalone:
      description: List of ports for use with Standalone.
      file: True
      global: True
      title: Standalone