securityonion/salt/firewall/soc_firewall.yaml

firewall:
  hostgroups:
    analyst_workstation:
      description: List of IP Addresses or CIDR blocks to allow analyst workstations.
      file: True
      global: True
      title: Analyst Workstation
      helpLink: firewall.html#host-groups
    analyst: 
      description: List of IP Addresses or CIDR blocks to allow analyst connections.
      file: True
      global: True
      title: Analyst
      helpLink: firewall.html#host-groups
    standalone: 
      description: List of IP Addresses or CIDR blocks to allow standalone connections.
      file: True
      global: True
      title: Standalone
      advanced: True
      helpLink: firewall.html#host-groups
    eval: 
      description: List of IP Addresses or CIDR blocks to allow eval connections.
      file: True
      global: True
      title: Eval
      advanced: True
      helpLink: firewall.html#host-groups
    idh: 
      description: List of IP Addresses or CIDR blocks to allow idh connections.
      file: True
      global: True
      title: IDHNode
      helpLink: firewall.html#host-groups
    manager: 
      description: List of IP Addresses or CIDR blocks to allow manager connections.
      file: True
      global: True
      title: Manager
      advanced: True
      helpLink: firewall.html#host-groups
    heavynodes: 
      description: List of IP Addresses or CIDR blocks to allow heavynode connections.
      file: True
      global: True
      title: HeavyNode
      helpLink: firewall.html#host-groups
    searchnodes: 
      description: List of IP Addresses or CIDR blocks to allow searchnode connections.
      file: True
      global: True
      title: SearchNode
      helpLink: firewall.html#host-groups
    sensors:
      description: List of IP Addresses or CIDR blocks to allow Sensor connections.
      file: True
      global: True
      title: Sensor
      helpLink: firewall.html#host-groups
    receivers: 
      description: List of IP Addresses or CIDR blocks to allow receiver connections.
      file: True
      global: True
      title: Receiver
      helpLink: firewall.html#host-groups
  portgroups:
    portgroups__yaml:
      description: Port Groups
      file: True
      global: True
      advanced: True
      title: Port Groups
      syntax: yaml
      helpLink: firewall.html#function
  ports:
    ports__yaml:
      description: Ports in YAML.
      file: True
      global: True
      advanced: True
      title: Ports
      syntax: yaml
      helpLink: firewall.html#port-groups