Add Globals

Security-Onion-Solutions · Jan 29, 2024 · 0c96931 · 0c96931
1 parent 5b05aec
commit 0c96931
Show file tree

Hide file tree

Showing 5 changed files with 22 additions and 3 deletions.
diff --git a/salt/global/defaults.yaml b/salt/global/defaults.yaml
@@ -0,0 +1,2 @@
+global:
+  pcapengine: STENO
diff --git a/salt/global/soc_global.yaml b/salt/global/soc_global.yaml
@@ -14,6 +14,11 @@ global:
     regex: ^(ZEEK|SURICATA)$
     regexFailureMessage: You must enter either ZEEK or SURICATA.
     global: True
+  pcapengine:
+    description: What engine to use for generating pcap. Options are STENO and SURICATA.
+    regex: ^(STENO|SURICATA)$
+    regexFailureMessage: You must enter either STENO or SURICATA.
+    global: True
   ids:
     description: Which IDS engine to use. Currently only Suricata is supported.
     global: True

diff --git a/salt/manager/tools/sbin/so-minion b/salt/manager/tools/sbin/so-minion
@@ -99,7 +99,8 @@ function pcapspace() {
 		"suricata:"\
 		"  config:"\
 		"    output:"\
-		"      pcap-log: $s" >> $PILLARFILE
+		"      pcap-log:"\
+		"        max-files: $s" >> $PILLARFILE
 
 }
 

diff --git a/salt/sensoroni/files/sensoroni.json b/salt/sensoroni/files/sensoroni.json
@@ -23,13 +23,22 @@
       "importer": {},
       "statickeyauth": {
         "apiKey": "{{ GLOBALS.sensoroni_key }}"
-{%- if PCAPMERGED.enabled %} 
+{%- if PCAPMERGED.enabled %}
+{%-   if PCAPENGINE.steno %} 
       },     
       "stenoquery": {
         "executablePath": "/opt/sensoroni/scripts/stenoquery.sh",
         "pcapInputPath": "/nsm/pcap",
         "pcapOutputPath": "/nsm/pcapout"
       }
+{%- elif PCAPENGINE.suri %}
+      },     
+      "suriquery": {
+        "executablePath": "/opt/sensoroni/scripts/suriquery.sh",
+        "pcapInputPath": "/nsm/suripcap",
+        "pcapOutputPath": "/nsm/pcapout"
+      }
+{%- endif %}
 {%- else %}
       }
 {%- endif %}

diff --git a/salt/suricata/soc_suricata.yaml b/salt/suricata/soc_suricata.yaml
@@ -155,8 +155,10 @@ suricata:
                 helpLink: suricata.html
       pcap-log:
         enabled:
-          description: Enable Suricata to collect PCAP.
+          description: This value is ignored by SO. pcapengine in globals takes predidence.
+          readonly: True
           helpLink: suricata.html
+          advanced: True
         compression: 
           description: Enable compression of Suricata PCAP. Currently unsupported
           advanced: True