Merge pull request #12584 from Security-Onion-Solutions/jertel/suripcap

handle airgap when detections not enabled
Security-Onion-Solutions · Mar 14, 2024 · 09bff01 · 09bff01
2 parents cc1356c + 844cfe5
commit 09bff01
Showing 1 changed file with 4 additions and 6 deletions.
diff --git a/salt/soc/merged.map.jinja b/salt/soc/merged.map.jinja
@@ -35,18 +35,16 @@
 {%   do SOCMERGED.config.server.modules.pop('elastalertengine') %}
 {%   do SOCMERGED.config.server.modules.pop('strelkaengine') %}
 {%   do SOCMERGED.config.server.modules.pop('suricataengine') %}
+{% elif pillar.global.airgap %}
+  {# if system is Airgap, don't autoupdate Yara & Sigma rules #}
+  {%   do SOCMERGED.config.server.modules.elastalertengine.update({'autoUpdateEnabled': false}) %}
+  {%   do SOCMERGED.config.server.modules.strelkaengine.update({'autoUpdateEnabled': false}) %}
 {% endif %}
 
 {% if pillar.manager.playbook == 0 %}
 {%   do SOCMERGED.config.server.client.inactiveTools.append('toolPlaybook') %}
 {% endif %}
 
-{# if system is Airgap, don't autoupdate Yara & Sigma rules #}
-{% if pillar.global.airgap %}
-  {%   do SOCMERGED.config.server.modules.elastalertengine.update({'autoUpdateEnabled': false}) %}
-  {%   do SOCMERGED.config.server.modules.strelkaengine.update({'autoUpdateEnabled': false}) %}
-{% endif %}
-
 {% set standard_actions = SOCMERGED.config.pop('actions') %}
 
 {% if pillar.global.endgamehost != '' %}