Problem with using sensor as hostgroup.

[piolug93]

Hello i try add custom firewall rule on /opt/so/saltstack/local/salt/firewall/assigned_hostgroups.local.map.yaml by adding

 role:
  eval:
  fleet:
  heavynode:
  helixsensor:
  idh:
  import:
  managersearch:
  receiver:
  standalone:
  searchnode:
  sensor:
    chain:
      DOCKER-USER:
        hostgroups:
          manager:
            portgroups:
              - {{ portgroups.wazuh_cluster }}
  manager:
    chain:
      DOCKER-USER:
        hostgroups:
          sensor:
            portgroups:
              - {{ portgroups.wazuh_cluster  }}

That configuration rule for manager doesn't was applied. When i change source from sensor to my own hostgroup "wazuh_cluster" or change chain to INPUT all i fine. Next experiment what i try is try bad entry as:

  manager:
    chain:
      DOCKER-USER:
        hostgroups:
          sensor:
              - {{ portgroups.wazuh_cluster  }}

To my suprise when i call so-firewall apply i don't receiv error.

[InfosecGoon]

If you're trying to add the wazuh_cluster portgroup to the firewall configuration on your Manager and Forward nodes, I would suggest doing it by modifying their minion pillar files rather than modifying the assigned_hostgroups.map.yaml file directly: https://docs.securityonion.net/en/2.3/firewall.html

[piolug93]

Why you suggest add that to minion pillar files ? In my configuration all forward node are node for wazuh. I solved described problem by create own hostgroup. However i think about why i can't use sensor hostgroup in DOCKER-USER chain. I searching explains, because that can have complication for other.