Merge pull request #12544 from Security-Onion-Solutions/jertel/status

pcap improvements
Security-Onion-Solutions · Mar 11, 2024 · 4355d5b · 4355d5b
2 parents 2ca96c7 + a55e04e
commit 4355d5b
Show file tree

Hide file tree

Showing 7 changed files with 19 additions and 28 deletions.
diff --git a/salt/pcap/config.sls b/salt/pcap/config.sls
@@ -72,13 +72,6 @@ stenoca:
     - user: 941
     - group: 939
 
-pcapdir:
-  file.directory:
-    - name: /nsm/pcap
-    - user: 941
-    - group: 941
-    - makedirs: True
-
 pcaptmpdir:
   file.directory:
     - name: /nsm/pcaptmp

diff --git a/salt/pcap/init.sls b/salt/pcap/init.sls
@@ -15,3 +15,12 @@ include:
 {% else %}
   - pcap.disabled
 {% endif %}
+
+# This directory needs to exist regardless of whether STENO is enabled or not, in order for
+# Sensoroni to be able to look at old steno PCAP data
+pcapdir:
+  file.directory:
+    - name: /nsm/pcap
+    - user: 941
+    - group: 941
+    - makedirs: True
diff --git a/salt/sensoroni/enabled.sls b/salt/sensoroni/enabled.sls
@@ -23,10 +23,7 @@ so-sensoroni:
       - /opt/so/conf/sensoroni/sensoroni.json:/opt/sensoroni/sensoroni.json:ro
       - /opt/so/conf/sensoroni/analyzers:/opt/sensoroni/analyzers:rw
       - /opt/so/log/sensoroni:/opt/sensoroni/logs:rw
-      {% if GLOBALS.pcap_engine == "SURICATA" %}
       - /nsm/suripcap/:/nsm/suripcap:rw
-      - /nsm/suripcaptmp:/nsm/suripcaptmp:rw
-      {% endif %}
       {% if DOCKER.containers['so-sensoroni'].custom_bind_mounts %}
         {% for BIND in DOCKER.containers['so-sensoroni'].custom_bind_mounts %}
       - {{ BIND }}

diff --git a/salt/sensoroni/files/sensoroni.json b/salt/sensoroni/files/sensoroni.json
@@ -23,29 +23,19 @@
       "statickeyauth": {
         "apiKey": "{{ GLOBALS.sensoroni_key }}"
 {%  if GLOBALS.is_sensor %}
-{%    from 'pcap/config.map.jinja' import PCAPMERGED %}
-{%    from 'suricata/map.jinja' import SURICATAMERGED %}
-{#    if PCAPMERGED.enabled is true then we know that steno is the pcap engine #}
-{#    if it is false, then user has steno disabled in ui or has selected suricata for pcap engine #}
-{%-   if PCAPMERGED.enabled %}
       },     
       "stenoquery": {
         "executablePath": "/opt/sensoroni/scripts/stenoquery.sh",
         "pcapInputPath": "/nsm/pcap",
         "pcapOutputPath": "/nsm/pcapout"
-      }
-{%-   elif GLOBALS.pcap_engine == "SURICATA" and SURICATAMERGED.enabled %}
       },     
       "suriquery": {
         "executablePath": "/opt/sensoroni/scripts/suriquery.sh",
         "pcapInputPath": "/nsm/suripcap",
         "pcapOutputPath": "/nsm/pcapout",
         "pcapMaxCount": {{ SENSORONIMERGED.config.suripcap.pcapMaxCount }}
-      }
-{%    endif %}
-{%- else %}
-      }
 {%- endif %}
+      }
     }
   }
 }
diff --git a/salt/suricata/enabled.sls b/salt/suricata/enabled.sls
@@ -12,9 +12,6 @@
 include:
   - suricata.config
   - suricata.sostatus
-{%   if GLOBALS.pcap_engine == "SURICATA" %}
-  - suricata.pcap
-{%   endif %}
 
 so-suricata:
   docker_container.running:
@@ -36,9 +33,7 @@ so-suricata:
       - /nsm/suricata/:/nsm/:rw
       - /nsm/suricata/extracted:/var/log/suricata//filestore:rw
       - /opt/so/conf/suricata/bpf:/etc/suricata/bpf:ro
-      {% if GLOBALS.pcap_engine == "SURICATA" %}
       - /nsm/suripcap/:/nsm/suripcap:rw
-      {% endif %}
       {% if DOCKER.containers['so-suricata'].custom_bind_mounts %}
         {% for BIND in DOCKER.containers['so-suricata'].custom_bind_mounts %}
       - {{ BIND }}

diff --git a/salt/suricata/init.sls b/salt/suricata/init.sls
@@ -7,6 +7,7 @@
 {% from 'suricata/map.jinja' import SURICATAMERGED %}
 
 include:
+  - suricata.pcap
 {% if SURICATAMERGED.enabled and GLOBALS.role != 'so-import' %}
   - suricata.enabled
 {% elif GLOBALS.role == 'so-import' %}

diff --git a/salt/suricata/pcap.sls b/salt/suricata/pcap.sls
@@ -1,14 +1,18 @@
 {% from 'vars/globals.map.jinja' import GLOBALS %}
 {% from 'suricata/map.jinja' import SURICATAMERGED %}
 
+# This directory needs to exist regardless of whether SURIPCAP is enabled or not, in order for
+# Sensoroni to be able to look at old Suricata PCAP data
 suripcapdir:
   file.directory:
     - name: /nsm/suripcap
     - user: 940
     - group: 939
-    - mode: 755
+    - mode: 775
     - makedirs: True
 
+{%   if GLOBALS.pcap_engine == "SURICATA" %}
+
 {# there should only be 1 interface in af-packet so we can just reference the first list item #}
 {% for i in range(1, SURICATAMERGED.config['af-packet'][0].threads + 1) %}
 
@@ -17,6 +21,8 @@ suripcapthread{{i}}dir:
     - name: /nsm/suripcap/{{i}}
     - user: 940
     - group: 939
-    - mode: 755
+    - mode: 775
 
 {% endfor %}
+
+{%   endif %}