securityonion/salt/firewall/soc_firewall.yaml

firewall:
  grid:
    hosts:
      analyst_workstations:
        description: List of IP Addresses or CIDR blocks to allow analyst workstations.
        global: True
        title: Analyst Workstations
      analyst: 
        description: List of IP Addresses or CIDR blocks to allow analyst connections.
        global: True
        title: Analysts
      standalone: 
        description: List of IP Addresses or CIDR blocks to allow standalone connections.
        global: True
        title: Standalone
        advanced: True
      eval: 
        description: List of IP Addresses or CIDR blocks to allow eval connections.
        global: True
        title: Eval
        advanced: True
      idh: 
        description: List of IP Addresses or CIDR blocks to allow idh connections.
        global: True
        title: IDH Nodes
      manager: 
        description: List of IP Addresses or CIDR blocks to allow manager connections.
        global: True
        title: Manager
        advanced: True
      heavynodes: 
        description: List of IP Addresses or CIDR blocks to allow heavynode connections.
        global: True
        title: Heavy Nodes
      searchnodes: 
        description: List of IP Addresses or CIDR blocks to allow searchnode connections.
        global: True
        title: Searchnodes
      receivers: 
        description: List of IP Addresses or CIDR blocks to allow receiver connections.
        global: True
        title: Receivers