salt usage

[udi-mosh]

Hi,
i am trying to config my so to receive logs from fortinet.
i have installed the system from so iso. i have 2 nodes, manager\search and forwarder.
i have several questions:

1. which node should receive the logs ?
2. which sls file do i need to configure ?
3. how do i edit the file ? i can't go into the slatstack folder because only socore is allowed. should i run "sudo salt cmd.run 'vi ?
   thanks,
   udi

[robbiemarshall]

Udi,

You can start with the documentation here: https://docs.securityonion.net/en/2.3/syslog.html

[udi-mosh]

read this before posting.
can't seem to understand what to do from the documentation.
i do not have access to the salt directories unless i use "sudo salt ..." and i do not know if i suppose to change permissions. the documentation does not encourage such changes

[udi-mosh]

find the solution. all i need to do is run "sudo vi"

[udi-mosh]

just to summarize...
read again the document and figure out file structure and salt operation.
since i am using the SO ISO and as recommended, i do not want to change permissions, i find out that i need to use "sudo vi..."