Customize IDH #12484
-
Version2.4.50 Installation MethodSecurity Onion ISO image Descriptionconfiguration Installation TypeDistributed Locationon-prem with Internet access Hardware SpecsExceeds minimum requirements CPU8 RAM32 Storage for /100GB Storage for /nsm500GB Network Traffic Collectionspan port Network Traffic Speeds1Gbps to 10Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsNo, there are no additional clues DetailHi. Guidelines
|
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 1 reply
-
|
If you made changes to the defaults.yaml under /opt/so/saltstack/default/salt/idh, then it will survive reboots, but your changes will be lost when Security Onion is upgraded. In order for the changes to persist through upgrades, then we need to add it to SOC. Since this option isn't exposed in SOC by default, then we have to add it via the advanced options: |
Beta Was this translation helpful? Give feedback.
-
|
A potential other solution to use here that I have implemented is to build an elastalert rule that looks in ".ds-logs-playbook.alerts-so*" Then use the Teams alerter that is native to elastalert to fire your alerts. So whenever an alert fires it will drop into that index and your rule will see it and alert you. This is how I alert on all of types of rules in SOC and Kibana. You can include the URL for the alert as well if you have one generate in the logs, or include a custom generated Kibana dashboard for it
https://elastalert.readthedocs.io/en/latest/ruletypes.html#common-configuration-options |
Beta Was this translation helpful? Give feedback.
-
|
Fantastic. Thank you guys! |
Beta Was this translation helpful? Give feedback.
If you made changes to the defaults.yaml under /opt/so/saltstack/default/salt/idh, then it will survive reboots, but your changes will be lost when Security Onion is upgraded. In order for the changes to persist through upgrades, then we need to add it to SOC. Since this option isn't exposed in SOC by default, then we have to add it via the advanced options: