How to edit suricata.yaml file

[technox123]

Version

2.4.50

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

24

RAM

128gb

Storage for /

500gb

Storage for /nsm

6tb

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Hi,

How would I go about editing the suricata.yaml file on a Forward sensor? As editing it directly on there just overrides the changes on a restart and sync.

I tried editing the <minion name>.sls file in /opt/so/saltstack/local/pillar/minions/ on the management node and adding block-size: <value> below the threads: section in af-packet, however upon a sync on the minion I got a salt error.

I then went to SOC and tried editing the advanced section and adding this:

suricata:
  config:
  af-packet:
      block-size: <value>

But this seems to have failed as the suricata.yaml file defaulted to the default values that you get after installation on the forward node.

I have also tried this:

suricata:
  config:
  af-packet:
    - interface: bond0
      block-size: <value>

But got the same issue upon sync'ing, the values of the .yaml file went back to default. I assume I'm entering something incorrectly here so any help would be appreciated.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

An issue for this has been opened #12637