diff --git a/salt/pcap/config.sls b/salt/pcap/config.sls index 9ea5cee658..eb37765c5c 100644 --- a/salt/pcap/config.sls +++ b/salt/pcap/config.sls @@ -72,13 +72,6 @@ stenoca: - user: 941 - group: 939 -pcapdir: - file.directory: - - name: /nsm/pcap - - user: 941 - - group: 941 - - makedirs: True - pcaptmpdir: file.directory: - name: /nsm/pcaptmp diff --git a/salt/pcap/init.sls b/salt/pcap/init.sls index 9de272ad7a..7a172e8fd8 100644 --- a/salt/pcap/init.sls +++ b/salt/pcap/init.sls @@ -15,3 +15,12 @@ include: {% else %} - pcap.disabled {% endif %} + +# This directory needs to exist regardless of whether STENO is enabled or not, in order for +# Sensoroni to be able to look at old steno PCAP data +pcapdir: + file.directory: + - name: /nsm/pcap + - user: 941 + - group: 941 + - makedirs: True \ No newline at end of file diff --git a/salt/sensoroni/enabled.sls b/salt/sensoroni/enabled.sls index 6dc3df2bd4..3f05568a03 100644 --- a/salt/sensoroni/enabled.sls +++ b/salt/sensoroni/enabled.sls @@ -23,10 +23,7 @@ so-sensoroni: - /opt/so/conf/sensoroni/sensoroni.json:/opt/sensoroni/sensoroni.json:ro - /opt/so/conf/sensoroni/analyzers:/opt/sensoroni/analyzers:rw - /opt/so/log/sensoroni:/opt/sensoroni/logs:rw - {% if GLOBALS.pcap_engine == "SURICATA" %} - /nsm/suripcap/:/nsm/suripcap:rw - - /nsm/suripcaptmp:/nsm/suripcaptmp:rw - {% endif %} {% if DOCKER.containers['so-sensoroni'].custom_bind_mounts %} {% for BIND in DOCKER.containers['so-sensoroni'].custom_bind_mounts %} - {{ BIND }} diff --git a/salt/sensoroni/files/sensoroni.json b/salt/sensoroni/files/sensoroni.json index eb9c1131d8..f40f73167f 100644 --- a/salt/sensoroni/files/sensoroni.json +++ b/salt/sensoroni/files/sensoroni.json @@ -23,29 +23,19 @@ "statickeyauth": { "apiKey": "{{ GLOBALS.sensoroni_key }}" {% if GLOBALS.is_sensor %} -{% from 'pcap/config.map.jinja' import PCAPMERGED %} -{% from 'suricata/map.jinja' import SURICATAMERGED %} -{# if PCAPMERGED.enabled is true then we know that steno is the pcap engine #} -{# if it is false, then user has steno disabled in ui or has selected suricata for pcap engine #} -{%- if PCAPMERGED.enabled %} }, "stenoquery": { "executablePath": "/opt/sensoroni/scripts/stenoquery.sh", "pcapInputPath": "/nsm/pcap", "pcapOutputPath": "/nsm/pcapout" - } -{%- elif GLOBALS.pcap_engine == "SURICATA" and SURICATAMERGED.enabled %} }, "suriquery": { "executablePath": "/opt/sensoroni/scripts/suriquery.sh", "pcapInputPath": "/nsm/suripcap", "pcapOutputPath": "/nsm/pcapout", "pcapMaxCount": {{ SENSORONIMERGED.config.suripcap.pcapMaxCount }} - } -{% endif %} -{%- else %} - } {%- endif %} + } } } } diff --git a/salt/suricata/enabled.sls b/salt/suricata/enabled.sls index fed5783e1d..d351605276 100644 --- a/salt/suricata/enabled.sls +++ b/salt/suricata/enabled.sls @@ -12,9 +12,6 @@ include: - suricata.config - suricata.sostatus -{% if GLOBALS.pcap_engine == "SURICATA" %} - - suricata.pcap -{% endif %} so-suricata: docker_container.running: @@ -36,9 +33,7 @@ so-suricata: - /nsm/suricata/:/nsm/:rw - /nsm/suricata/extracted:/var/log/suricata//filestore:rw - /opt/so/conf/suricata/bpf:/etc/suricata/bpf:ro - {% if GLOBALS.pcap_engine == "SURICATA" %} - /nsm/suripcap/:/nsm/suripcap:rw - {% endif %} {% if DOCKER.containers['so-suricata'].custom_bind_mounts %} {% for BIND in DOCKER.containers['so-suricata'].custom_bind_mounts %} - {{ BIND }} diff --git a/salt/suricata/init.sls b/salt/suricata/init.sls index 64a000109d..f6ddce862b 100644 --- a/salt/suricata/init.sls +++ b/salt/suricata/init.sls @@ -7,6 +7,7 @@ {% from 'suricata/map.jinja' import SURICATAMERGED %} include: + - suricata.pcap {% if SURICATAMERGED.enabled and GLOBALS.role != 'so-import' %} - suricata.enabled {% elif GLOBALS.role == 'so-import' %} diff --git a/salt/suricata/pcap.sls b/salt/suricata/pcap.sls index a3cbafa0ac..665262477d 100644 --- a/salt/suricata/pcap.sls +++ b/salt/suricata/pcap.sls @@ -1,14 +1,18 @@ {% from 'vars/globals.map.jinja' import GLOBALS %} {% from 'suricata/map.jinja' import SURICATAMERGED %} +# This directory needs to exist regardless of whether SURIPCAP is enabled or not, in order for +# Sensoroni to be able to look at old Suricata PCAP data suripcapdir: file.directory: - name: /nsm/suripcap - user: 940 - group: 939 - - mode: 755 + - mode: 775 - makedirs: True +{% if GLOBALS.pcap_engine == "SURICATA" %} + {# there should only be 1 interface in af-packet so we can just reference the first list item #} {% for i in range(1, SURICATAMERGED.config['af-packet'][0].threads + 1) %} @@ -17,6 +21,8 @@ suripcapthread{{i}}dir: - name: /nsm/suripcap/{{i}} - user: 940 - group: 939 - - mode: 755 + - mode: 775 {% endfor %} + +{% endif %}