securityonion/salt/salt/files/engines.conf

engines_dirs:
  - /etc/salt/engines

engines:
  - checkmine:
      interval: 60
  - pillarWatch:
      fpa:
        - files:
            - /opt/so/saltstack/local/pillar/global/soc_global.sls
            - /opt/so/saltstack/local/pillar/global/adv_global.sls
          pillar: global.pipeline
          default: REDIS
          actions:
            from:
              '*':
                to:
                  'KAFKA':
                  - cmd.run:
                      cmd: /usr/sbin/so-yaml.py replace /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls kafka.enabled True
                  - cmd.run:
                      cmd: salt -C 'G@role:so-standalone or G@role:so-manager or G@role:so-managersearch or G@role:so-receiver or G@role:so-searchnode' saltutil.kill_all_jobs
                  - cmd.run:
                      cmd: salt-call state.apply kafka.nodes
                  - cmd.run:
                      cmd: salt -C 'G@role:so-standalone or G@role:so-manager or G@role:so-managersearch or G@role:so-receiver or G@role:so-searchnode' state.highstate
              'KAFKA':
                to:
                  'REDIS':
                  - cmd.run:
                      cmd: /usr/sbin/so-yaml.py replace /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls kafka.enabled False
                  - cmd.run:
                      cmd: salt -C 'G@role:so-standalone or G@role:so-manager or G@role:so-managersearch or G@role:so-receiver or G@role:so-searchnode' saltutil.kill_all_jobs
                  - cmd.run:
                      cmd: salt -C 'G@role:so-standalone or G@role:so-manager or G@role:so-managersearch or G@role:so-receiver or G@role:so-searchnode' state.highstate
        - files:
            - /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls
            - /opt/so/saltstack/local/pillar/kafka/adv_kafka.sls
          pillar: kafka.controllers
          default: ''
          actions:
            from:
              '*':
                to:
                  '*':
                  - cmd.run:
                      cmd: salt -C 'G@role:so-standalone or G@role:so-manager or G@role:so-managersearch or G@role:so-receiver' saltutil.kill_all_jobs
                  - cmd.run:
                      cmd: salt-call state.apply kafka.nodes
                  - cmd.run:
                      cmd: salt -C 'G@role:so-standalone or G@role:so-manager or G@role:so-managersearch or G@role:so-receiver' state.apply kafka
                  - cmd.run:
                      cmd: salt-call state.apply elasticfleet
        - files:
            - /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls
            - /opt/so/saltstack/local/pillar/kafka/adv_kafka.sls
          pillar: kafka.reset
          default: ''
          actions:
            from:
              '*':
                to:
                  'YES_RESET_KAFKA':
                  - cmd.run:
                      cmd: salt -C 'G@role:so-standalone or G@role:so-manager or G@role:so-managersearch or G@role:so-receiver' saltutil.kill_all_jobs
                  - cmd.run:
                      cmd: salt -C 'G@role:so-standalone or G@role:so-manager or G@role:so-managersearch or G@role:so-receiver' state.apply kafka.disabled,kafka.reset
                  - cmd.run:
                      cmd: /usr/sbin/so-yaml.py remove /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls kafka.reset
      interval: 10