Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change Factoring for so-minion pcap disk space #12513

Merged
merged 10 commits into from
Mar 7, 2024
Merged

Change Factoring for so-minion pcap disk space #12513

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
f58c104
Update so-minion
TOoSmOotH Mar 6, 2024
a63fca7
Update soc_suricata.yaml
TOoSmOotH Mar 6, 2024
f836d6a
Update so-minion
TOoSmOotH Mar 6, 2024
4dfa1a5
Move Suricata around
TOoSmOotH Mar 6, 2024
ad12093
Fix percent calc
TOoSmOotH Mar 6, 2024
9a413a2
Fix location of repo
TOoSmOotH Mar 6, 2024
7f1e786
Consolidate PCAP settings
TOoSmOotH Mar 6, 2024
cf23253
move suricata.pcap to suricata.config.outputs.pcap-log
m0duspwnens Mar 6, 2024
5832272
fix max-files calc
m0duspwnens Mar 6, 2024
70f3ce0
change how maxfiles is calculated
m0duspwnens Mar 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
move suricata.pcap to suricata.config.outputs.pcap-log
  • Loading branch information
@m0duspwnens
m0duspwnens committed Mar 6, 2024
commit cf232534ca9a1609da8946adc24dd5f7116cfc24
12 changes: 12 additions & 0 deletions salt/suricata/map.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,18 @@
{# before we change outputs back to list, enable pcap-log if suricata is the pcapengine #}
{% if GLOBALS.pcap_engine == "SURICATA" %}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'enabled': 'yes'}) %}
{# move the items in suricata.pcap into suricata.config.outputs.pcap-log. these items were placed under suricata.config for ease of access in SOC #}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'compression': SURICATAMERGED.pcap.compression}) %}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'lz4-checksum': SURICATAMERGED.pcap['lz4-checksum']}) %}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'lz4-level': SURICATAMERGED.pcap['lz4-level']}) %}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'filename': SURICATAMERGED.pcap.filename}) %}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'limit': SURICATAMERGED.pcap.filesize}) %}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'mode': SURICATAMERGED.pcap.mode}) %}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'max-stream-depth': SURICATAMERGED.pcap['max-stream-depth']}) %}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'conditional': SURICATAMERGED.pcap.conditional}) %}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'dir': SURICATAMERGED.pcap.dir}) %}
{% set maxfiles = (SURICATAMERGED.pcap.maxsize / SURICATAMERGED.pcap.filesize) | round | int %}
{% do SURICATAMERGED.config.outputs['pcap-log'].update({'max-files': maxfiles}) %}
{% endif %}

{# outputs is a list but we convert to dict in defaults to work with ui #}
Expand Down
Loading