What should the threshold salt file be called under /opt/so/saltstack/local/pillar/thresholding/?

[w4rc0n]

I'm looking at the docs at: https://docs.securityonion.net/en/2.3/managing-alerts.html

I don't have any files under /opt/so/saltstack/local/pillar/thresholding/ on my manager node. The docs reference 2 files that contain examples, but I'm not sure what the actual file should be called should someone want to set up threshold rules.

[cm-ops]

The pillar example is in /opt/so/saltstack/default/pillar/thresholding. The example in the docs is the same. You use that salt pillar and add it to one of the .sls files below.

If you want to set up threshold rules to apply the threshold to all nodes, place the pillar in /opt/so/saltstack/local/pillar/global.sls. If you want to apply the threshold to a single node, place the pillar in /opt/so/saltstack/local/pillar/minions/<MINION_ID>.sls. Then restart suricata with sudo salt 'sensorname' cmd.run 'so-suricata-restart'.

[w4rc0n]

Thank you