Suppress same rule for more hosts

[jobbe997]

maybe I'm nog reading the documentation right but this makes salt fail to compile, when 2000488 is mentioned twice.

thresholding:
sids:
2000488:
- suppress:
gen_id: 1
track: by_src
ip: 1.1.1.1
2000488:
- suppress:
gen_id: 1
track: by_dst
ip: 1.1.1.2

this also makes salt fail,

thresholding:
sids:
2000488:
- suppress:
gen_id: 1
track: by_src
ip: 1.1.1.1
- suppress:
gen_id: 1
track: by_dst
ip: 1.1.1.2

[dougburks]

This appears to be working correctly for me:

thresholding:
  sids:
    2000488:
      - suppress:
          gen_id: 1
          track: by_src
          ip: 1.1.1.1
      - suppress:
          gen_id: 1
          track: by_dst
          ip: 1.1.1.2

[jobbe997]

I just get:
_sensor:
Data failed to compile:

thresholding:
  sids:
    2000488:
      - suppress:
           gen_id: 1
           track: by_src
           ip: 1.1.1.1
      - suppress:
           gen_id: 1
           track: by_src
           ip: 1.1.1.2

If I remove the second suppress it compiles fine.

[dougburks]

I just copied your exact block into /opt/so/saltstack/local/pillar/global.sls , ran salt-call state.apply suricata, and it successfully added the following entries to /opt/so/conf/suricata/threshold.conf:

suppress gen_id 1, sig_id 2000488, track by_src, ip 1.1.1.1
suppress gen_id 1, sig_id 2000488, track by_src, ip 1.1.1.2

[jobbe997]

You do this on the manager node? The documentation mentions static.sls but that one did not work at all for me, so I added in the minions/sen_sensor.sls file as also is in the documentation, then they are added to /opt/so/conf/suricata/threshold.conf using (salt '*' state.highstate).

I just tried and moved all to /opt/so/saltstack/local/pillar/global.sls and ran "salt-call state.apply suricata" and nothing is added to my threshold.conf file.

[dougburks]

Yes, any changes to salt config should be done on the manager. If you don't see your changes take effect at first, you could try running the state.highstate on the manager first and verifying no errors. Then go to the forward node, run the state.highstate, verify no errors, and then check threshold.conf.

(I should clarify that, in my previous reply, I used salt-call state.apply suricata because I was doing quick testing on a standalone installation at the time.)

[jobbe997]

adding to global.sls and then running "salt '*' state.highstate" fixed it :)