securityonion/files/firewall/hostgroups.local.yaml

firewall:
  hostgroups:
    analyst:
      ips:
        delete:
        insert:
    beats_endpoint:
      ips:
        delete:
        insert:
    beats_endpoint_ssl:
      ips:
        delete:
        insert:
    fleet:
      ips:
        delete:
        insert:
    heavy_node:
      ips:
        delete:
        insert:
    master:
      ips:
        delete:
        insert:
    minion:
      ips:
        delete:
        insert:
    node:
      ips:
        delete:
        insert:
    osquery_endpoint:
      ips:
        delete:
        insert:
    search_node:
      ips:
        delete:
        insert:
    sensor:
      ips:
        delete:
        insert:
    strelka_frontend:
      ips:
        delete:
        insert:
    syslog:
      ips:
        delete:
        insert:
    wazuh_agent:
      ips:
        delete:
        insert:
    wazuh_api:
      ips:
        delete:
        insert:
    wazuh_authd:
      ips:
        delete:
        insert: