Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FIX: Annotations for BPF and Suricata PCAP #12626 #12627

Merged
merged 4 commits into from
Mar 20, 2024
Merged

FIX: Annotations for BPF and Suricata PCAP #12626 #12627

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
876690a
FIX: Annotations for BPF and Suricata PCAP #12626
dougburks Mar 20, 2024
d2fb067
FIX: Annotations for BPF and Suricata PCAP #12626
dougburks Mar 20, 2024
fff4d20
Update soc_suricata.yaml
dougburks Mar 20, 2024
f3b9213
FIX: Annotations for BPF and Suricata PCAP #12626
dougburks Mar 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion salt/bpf/soc_bpf.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
bpf:
pcap:
description: List of BPF filters to apply to PCAP.
description: List of BPF filters to apply to Stenographer.
multiline: True
forcedType: "[]string"
helpLink: bpf.html
Expand Down
18 changes: 9 additions & 9 deletions salt/suricata/soc_suricata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,26 +21,26 @@ suricata:
helpLink: suricata.html
pcap:
filesize:
description: Max file size for individual PCAP files written by Suricata. Increasing this number could improve write performance at the expense of pcap retrieval times.
description: Maximum file size for individual PCAP files written by Suricata. Increasing this number could improve write performance at the expense of pcap retrieval time.
advanced: True
helplink: suricata.html
helpLink: suricata.html
maxsize:
description: Size in GB for total usage size of PCAP on disk.
helplink: suricata.html
description: Maximum size in GB for total disk usage of all PCAP files written by Suricata.
helpLink: suricata.html
compression:
description: Enable compression of Suricata PCAP.
description: Enable compression of Suricata PCAP files.
advanced: True
helpLink: suricata.html
lz4-checksum:
description: Enable PCAP lz4 checksum.
advanced: True
helpLink: suricata.html
lz4-level:
description: lz4 compression level of PCAP. 0 for no compression 16 for max compression.
description: lz4 compression level of PCAP files. Set to 0 for no compression. Set to 16 for maximum compression.
advanced: True
helpLink: suricata.html
filename:
description: Filename output for Suricata PCAP.
description: Filename output for Suricata PCAP files.
advanced: True
readonly: True
helpLink: suricata.html
Expand All @@ -50,13 +50,13 @@ suricata:
readonly: True
helpLink: suricata.html
use-stream-depth:
description: Set to "no" to ignore the stream depth and capture the entire flow. Set this to "yes" to truncate the flow based on the stream depth.
description: Set to "no" to ignore the stream depth and capture the entire flow. Set to "yes" to truncate the flow based on the stream depth.
advanced: True
regex: ^(yes|no)$
regexFailureMessage: You must enter either yes or no.
helpLink: suricata.html
conditional:
description: Set to "all" to capture PCAP for all flows. Set to "alerts" to capture PCAP just for alerts or set to "tag" to capture PCAP for just tagged rules.
description: Set to "all" to record PCAP for all flows. Set to "alerts" to only record PCAP for Suricata alerts. Set to "tag" to only record PCAP for tagged rules.
regex: ^(all|alerts|tag)$
regexFailureMessage: You must enter either all, alert or tag.
helpLink: suricata.html
Expand Down
Loading