so-yara-update in airgap

[darth-drew]

Team, Requesting clarification on so-yara-update documentation and code update.

The script does not appear to be working in an airgapped environment as I originally believed it would before reading the code that generates /sbin/so-yara-update.

After copying repos.txt in to local and updating with our internal gitlab servers, the script is still using the default airgapped path for rule updates. We have two gitlab servers we would like to pull from behind the same airgap, however the logic in the script seems like it will only check github servers if the manager is connected to the internet. I think it would be ideal to allow for arguments to so-yara-update, or some other mechanism to allow for updates from internal gitlab/hub instances without having to significantly alter the local copy. We have a work around, but figured it might be worth opening a discussion on.

[dougburks]

It's designed to be self-contained and thus not require the end user to set up a separate gitlab instance.

[darth-drew]

Doug,

Thank you for the response. This documentation here is why I originally went down this path:
https://docs.securityonion.net/en/2.3/local-rules.html?highlight=so-yara-update#remotely-managed-rules

[darth-drew]

Perhaps this documentation could use some clarification?

[dougburks]

I've changed this to:

If you have Internet access and want to have so-yara-update pull YARA rules from a Github repo, copy /opt/so/saltstack/local/salt/strelka/rules/, and modify repos.txt to include the repo URL (one per line).

[darth-drew]

Thanks Doug! Hopefully that saves someone else some time.