securityonion/salt/manager/files/beacons_pushstate.conf.jinja

{% from 'salt/auto_apply.map.jinja' import AUTOAPPLY %}
beacons:
  pillar_db:
    - interval: {{ AUTOAPPLY.drain_interval }}
    - disable_during_state_run: False
  inotify:
    - disable_during_state_run: False
    - coalesce: True
    - files:
        /opt/so/saltstack/local/salt/suricata/rules:
          mask:
            - close_write
            - moved_to
            - delete
          recurse: True
          auto_add: True
          exclude:
            - '\.sw[a-z]$':
                regex: True
            - '~$':
                regex: True
            - '/4913$':
                regex: True
            - '/\.#':
                regex: True
        /opt/so/saltstack/local/salt/strelka/rules/compiled:
          mask:
            - close_write
            - moved_to
            - delete
          recurse: True
          auto_add: True
          exclude:
            - '\.sw[a-z]$':
                regex: True
            - '~$':
                regex: True
            - '/4913$':
                regex: True
            - '/\.#':
                regex: True