mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-13 04:32:48 +01:00
33 lines
1.4 KiB
Bash
Executable File
33 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
|
. /usr/sbin/so-common
|
|
|
|
{%- from 'vars/globals.map.jinja' import GLOBALS %}
|
|
{%- from 'idstools/map.jinja' import IDSTOOLSMERGED %}
|
|
{%- set proxy = salt['pillar.get']('manager:proxy') %}
|
|
|
|
mkdir -p /nsm/rules/suricata
|
|
chown -R socore:socore /nsm/rules/suricata
|
|
# Download the rules from the internet
|
|
{%- if GLOBALS.airgap != 'True' %}
|
|
{%- if proxy %}
|
|
export http_proxy={{ proxy }}
|
|
export https_proxy={{ proxy }}
|
|
export no_proxy= salt['pillar.get']('manager:no_proxy')
|
|
{%- endif %}
|
|
{%- if IDSTOOLSMERGED.config.ruleset == 'ETOPEN' %}
|
|
docker exec so-idstools idstools-rulecat -v --suricata-version 6.0 -o /nsm/rules/suricata/ --merged=/nsm/rules/suricata/emerging-all.rules --force
|
|
{%- elif IDSTOOLSMERGED.config.ruleset == 'ETPRO' %}
|
|
docker exec so-idstools idstools-rulecat -v --suricata-version 6.0 -o /nsm/rules/suricata/ --merged=/nsm/rules/suricata/emerging-all.rules --force --etpro={{ IDSTOOLSMERGED.config.oinkcode }}
|
|
{%- elif IDSTOOLSMERGED.config.ruleset == 'TALOS' %}
|
|
docker exec so-idstools idstools-rulecat -v --suricata-version 6.0 -o /nsm/rules/suricata/ --merged=/nsm/rules/suricata/emerging-all.rules --force --url=https://www.snort.org/rules/snortrules-snapshot-2983.tar.gz?oinkcode={{ IDSTOOLSMERGED.config.oinkcode }}
|
|
{%- endif %}
|
|
{%- endif %}
|
|
|
|
|
|
argstr=""
|
|
for arg in "$@"; do
|
|
argstr="${argstr} \"${arg}\""
|
|
done
|
|
|
|
docker exec so-idstools /bin/bash -c "cd /opt/so/idstools/etc && idstools-rulecat --force ${argstr}"
|