transitional pcap

salt/bpf/pcap.map.jinja

@@ -1,7 +1,10 @@
-{% import_yaml 'bpf/defaults.yaml' as BPFDEFAULTS %}
-{% set BPFMERGED = salt['pillar.get']('bpf', BPFDEFAULTS.bpf, merge=True) %}
-{% import 'bpf/macros.jinja' as MACROS %}
-
-{{ MACROS.remove_comments(BPFMERGED, 'pcap') }}
-
-{% set PCAPBPF = BPFMERGED.pcap %}
+{% from 'vars/globals.map.jinja' import GLOBALS %}
+{% if GLOBALS.pcap_engine == "TRANSITION" %}
+{%   set PCAPBPF = ["ip and host 255.255.255.1 and port 1"] %}
+{% else %}
+{%   import_yaml 'bpf/defaults.yaml' as BPFDEFAULTS %}
+{%   set BPFMERGED = salt['pillar.get']('bpf', BPFDEFAULTS.bpf, merge=True) %}
+{%   import 'bpf/macros.jinja' as MACROS %}
+{{   MACROS.remove_comments(BPFMERGED, 'pcap') }}
+{%   set PCAPBPF = BPFMERGED.pcap %}
+{% endif %}

salt/global/soc_global.yaml

@@ -15,9 +15,9 @@ global:
     regexFailureMessage: You must enter either ZEEK or SURICATA.
     global: True
   pcapengine:
-    description: Which engine to use for generating pcap. Options are STENO and SURICATA.
-    regex: ^(STENO|SURICATA)$
-    regexFailureMessage: You must enter either STENO or SURICATA.
+    description: Which engine to use for generating pcap. Options are STENO, SURICATA or TRANSITION.
+    regex: ^(STENO|SURICATA|TRANSITION)$
+    regexFailureMessage: You must enter either STENO, SURICATA or TRANSITION.
     global: True
   ids:
     description: Which IDS engine to use. Currently only Suricata is supported.

salt/soc/defaults.yaml

@@ -1132,7 +1132,8 @@ soc:
           compileYaraPythonScriptPath: /opt/so/conf/strelka/compile_yara.py
           reposFolder: /opt/sensoroni/yara/repos
           rulesRepos:
-          - https://github.com/Security-Onion-Solutions/securityonion-yara
+          - repo: https://github.com/Security-Onion-Solutions/securityonion-yara
+            license: DRL
           yaraRulesFolder: /opt/sensoroni/yara/rules
         suricataengine:
           communityRulesFile: /nsm/rules/suricata/emerging-all.rules

salt/suricata/map.jinja

@@ -9,7 +9,7 @@
 {% set surimeta_filestore_index = [] %}
 
 {# before we change outputs back to list, enable pcap-log if suricata is the pcapengine #}
-{% if GLOBALS.pcap_engine == "SURICATA" %}
+{% if GLOBALS.pcap_engine in ["SURICATA", "TRANSITION"] %}
 {%   do SURICATAMERGED.config.outputs['pcap-log'].update({'enabled': 'yes'}) %}
 {#   move the items in suricata.pcap into suricata.config.outputs.pcap-log. these items were placed under suricata.config for ease of access in SOC #}
 {%   do SURICATAMERGED.config.outputs['pcap-log'].update({'compression': SURICATAMERGED.pcap.compression}) %}

salt/suricata/pcap.sls

@@ -11,7 +11,7 @@ suripcapdir:
     - mode: 775
     - makedirs: True
 
-{%   if GLOBALS.pcap_engine == "SURICATA" %}
+{%   if GLOBALS.pcap_engine in ["SURICATA", "TRANSITION"] %}
 
 {# there should only be 1 interface in af-packet so we can just reference the first list item #}
 {% for i in range(1, SURICATAMERGED.config['af-packet'][0].threads + 1) %}

salt/telegraf/scripts/oldpcap.sh

@@ -5,7 +5,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- if GLOBALS.pcap_engine == "SURICATA" %}
+{%- if GLOBALS.pcap_engine in ["SURICATA", "TRANSITION"] %}
 PCAPLOC=/host/nsm/suripcap
 {%- else %}
 PCAPLOC=/host/nsm/pcap