mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
33 lines
1.2 KiB
Plaintext
33 lines
1.2 KiB
Plaintext
{%- set URLS = salt['pillar.get']('idstools:config:urls') -%}
|
|
{%- set RULESET = salt['pillar.get']('idstools:config:ruleset') -%}
|
|
{%- set OINKCODE = salt['pillar.get']('idstools:config:oinkcode', '' ) -%}
|
|
{%- set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') -%}
|
|
{%- set MANAGERIP = salt['pillar.get']('global:managerip', '') -%}
|
|
{%- if ISAIRGAP is sameas true -%}
|
|
--merged=/opt/so/rules/nids/all.rules
|
|
--local=/opt/so/rules/nids/local.rules
|
|
--url=http://{{ MANAGERIP }}:7788/rules/emerging-all.rules
|
|
--disable=/opt/so/idstools/etc/disable.conf
|
|
--enable=/opt/so/idstools/etc/enable.conf
|
|
--modify=/opt/so/idstools/etc/modify.conf
|
|
{%- else -%}
|
|
--suricata-version=5.0
|
|
--merged=/opt/so/rules/nids/all.rules
|
|
--local=/opt/so/rules/nids/local.rules
|
|
--disable=/opt/so/idstools/etc/disable.conf
|
|
--enable=/opt/so/idstools/etc/enable.conf
|
|
--modify=/opt/so/idstools/etc/modify.conf
|
|
{%- if RULESET == 'ETOPEN' %}
|
|
--etopen
|
|
{%- elif RULESET == 'ETPRO' %}
|
|
--etpro={{ OINKCODE }}
|
|
{%- elif RULESET == 'TALOS' %}
|
|
--url=https://www.snort.org/rules/snortrules-snapshot-2983.tar.gz?oinkcode={{ OINKCODE }}
|
|
{%- endif %}
|
|
{%- endif %}
|
|
{%- if URLS != None %}
|
|
{%- for URL in URLS %}
|
|
--url={{ URL }}
|
|
{%- endfor %}
|
|
{%- endif %}
|