From abd7b8a69f63f82b9ae201470fd543b8d480f331 Mon Sep 17 00:00:00 2001 From: Josh Patterson Date: Mon, 24 Aug 2026 15:56:28 -0400 Subject: [PATCH 1/2] Remove Auto State Apply Known Issue for local/salt files securityonion now watches the directories under /opt/so/saltstack/local/salt/ that these pages tell users to edit, so hand-placed files are applied within a few minutes instead of waiting for the next scheduled highstate. Drop the Known Issues entry and turn the "not detected, so this step is required" caveats on the zeek, elasticsearch, and rbac pages back into an optional "if you don't want to wait" step. Document the watched directories under Auto State Apply in salt.md, and say plainly that anything else under local/salt/ still waits for the highstate. Also correct two stale claims: - zeek.md said intel and zkg packages reach separate sensor nodes only at their next highstate. Auto State Apply targets every node running Zeek. - logstash.md said a defined_pipelines change waits for the next highstate. That is a SOC config save, which Auto State Apply has always detected. --- docs/elasticsearch.md | 2 +- docs/logstash.md | 4 ++-- docs/rbac.md | 2 +- docs/release-notes.md | 8 -------- docs/salt.md | 14 ++++++++++++++ docs/zeek.md | 4 ++-- 6 files changed, 20 insertions(+), 14 deletions(-) diff --git a/docs/elasticsearch.md b/docs/elasticsearch.md index b3a666f8..592bda25 100644 --- a/docs/elasticsearch.md +++ b/docs/elasticsearch.md @@ -65,7 +65,7 @@ You can configure Elasticsearch by going to [Administration](administration.md) ## Parsing -Elasticsearch receives unparsed logs from [Logstash](logstash.md) or [Elastic Agent](elastic-agent.md). Elasticsearch then parses and stores those logs. Parsers are stored in `/opt/so/conf/elasticsearch/ingest/`. Custom ingest parsers can be placed in `/opt/so/saltstack/local/salt/elasticsearch/files/ingest/`. Files placed here are not detected by [Auto State Apply](salt.md#auto-state-apply), so to make these changes take effect, apply the Elasticsearch state to all nodes running Elasticsearch: +Elasticsearch receives unparsed logs from [Logstash](logstash.md) or [Elastic Agent](elastic-agent.md). Elasticsearch then parses and stores those logs. Parsers are stored in `/opt/so/conf/elasticsearch/ingest/`. Custom ingest parsers can be placed in `/opt/so/saltstack/local/salt/elasticsearch/files/ingest/`. [Auto State Apply](salt.md#auto-state-apply) picks these up within a few minutes. If you don't want to wait, apply the Elasticsearch state to all nodes running Elasticsearch: ``` diff --git a/docs/logstash.md b/docs/logstash.md index 3d7547fd..94a8459b 100644 --- a/docs/logstash.md +++ b/docs/logstash.md @@ -71,7 +71,7 @@ In [SOC](security-onion-console.md), navigate to [Administration](administration custom/myfile.conf ``` -The configuration will be applied at the next scheduled highstate (see [Highstate Interval](salt.md#highstate-interval)) or you can apply it immediately by clicking the `SYNCHRONIZE GRID` button under the `Options` menu. +[Auto State Apply](salt.md#auto-state-apply) will apply the configuration within a few minutes. If you don't want to wait, click the `SYNCHRONIZE GRID` button under the `Options` menu. You can monitor events flowing through the output by running the following command on the manager: @@ -82,7 +82,7 @@ curl -s localhost:9600/_node/stats | jq .pipelines.manager ## Modified Event Forwarding -To forward events to an external destination AFTER they have traversed the Logstash pipelines (NOT ingest node pipelines), perform the same steps as above but instead of adding the reference for your Logstash output to the `manager` pipeline add it to `search` pipeline instead. The configuration will be applied at the next scheduled highstate (see [Highstate Interval](salt.md#highstate-interval)) or immediately by clicking the `SYNCHRONIZE GRID` button under the `Options` menu. +To forward events to an external destination AFTER they have traversed the Logstash pipelines (NOT ingest node pipelines), perform the same steps as above but instead of adding the reference for your Logstash output to the `manager` pipeline add it to `search` pipeline instead. [Auto State Apply](salt.md#auto-state-apply) will apply the configuration within a few minutes. If you don't want to wait, click the `SYNCHRONIZE GRID` button under the `Options` menu. You can monitor events flowing through the output by running the following command on the search nodes: diff --git a/docs/rbac.md b/docs/rbac.md index fea1901c..0935f715 100644 --- a/docs/rbac.md +++ b/docs/rbac.md @@ -171,7 +171,7 @@ These steps will guide you through an example where we wish to introduce a new r sudo so-elasticsearch-query _security/privilege/kibana-.Kibana | jq '. | map_values(keys)' ``` -3. Role files are not detected by [Auto State Apply](salt.md#auto-state-apply), so this step is required. Run so-checkin from the manager: +3. [Auto State Apply](salt.md#auto-state-apply) picks up the new role file within a few minutes. If you don't want to wait, run so-checkin from the manager: ``` diff --git a/docs/release-notes.md b/docs/release-notes.md index a78510ef..e732ce9c 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -2,14 +2,6 @@ ### Known Issues -[Auto State Apply](salt.md#auto-state-apply) detects configuration changes saved in [Administration](administration.md) --> Configuration and rule updates on the manager node. Files that you create or edit directly under `/opt/so/saltstack/local/salt/` are not detected. After adding or changing any of the following, apply the relevant state from the manager or wait for the next scheduled highstate (see [Highstate Interval](salt.md#highstate-interval)): - -- [Zeek](zeek.md) intel in `/opt/so/saltstack/local/salt/zeek/policy/intel/` -- [Zeek](zeek.md) custom packages in `/opt/so/saltstack/local/salt/zeek/zkg/` -- [Elasticsearch](elasticsearch.md) custom ingest parsers in `/opt/so/saltstack/local/salt/elasticsearch/files/ingest/` -- [RBAC](rbac.md) custom Elastic stack role files in `/opt/so/saltstack/local/salt/elasticsearch/roles/` -- [Logstash](logstash.md) custom pipeline configuration files in `/opt/so/saltstack/local/salt/logstash/pipelines/config/custom/` - For all other known issues, please see . ### Release History diff --git a/docs/salt.md b/docs/salt.md index 3632043c..1c4fad8c 100644 --- a/docs/salt.md +++ b/docs/salt.md @@ -43,6 +43,20 @@ sudo so-checkin When you save a configuration change in [Administration](administration.md) --> Configuration, or when rules are updated on the manager node, Security Onion detects the change and applies the affected state to only the nodes that need it. This typically happens within a few minutes instead of waiting for the next scheduled highstate. +Files that you create or edit by hand on the manager in any of the following directories are detected the same way: + +| Directory | What it holds | +|-----------|---------------| +| `/opt/so/saltstack/local/salt/zeek/policy/` | [Zeek](zeek.md) intel and custom policies | +| `/opt/so/saltstack/local/salt/zeek/zkg/` | [Zeek](zeek.md) custom packages | +| `/opt/so/saltstack/local/salt/elasticsearch/files/ingest/` | [Elasticsearch](elasticsearch.md) custom ingest parsers | +| `/opt/so/saltstack/local/salt/elasticsearch/roles/` | [RBAC](rbac.md) custom Elastic stack role files | +| `/opt/so/saltstack/local/salt/logstash/pipelines/config/custom/` | [Logstash](logstash.md) custom pipeline configuration files | +| `/opt/so/saltstack/local/salt/suricata/rules/` | [Suricata](suricata.md) rules | +| `/opt/so/saltstack/local/salt/strelka/rules/compiled/` | [Strelka](strelka.md) compiled YARA rules | + +Other files under `/opt/so/saltstack/local/salt/` are not watched and are picked up at the next scheduled highstate (see [Highstate Interval](#highstate-interval)). + Auto State Apply is configured at [Administration](administration.md) --> Configuration --> salt --> auto_apply: | Setting | Default | Description | diff --git a/docs/zeek.md b/docs/zeek.md index b1db11ab..caef1b23 100644 --- a/docs/zeek.md +++ b/docs/zeek.md @@ -117,7 +117,7 @@ Please note that Zeek is very strict about the format of `intel.dat`. When editi The default `intel.dat` file follows these guidelines so you can reference it as an example of the proper format. -Intel files are not detected by [Auto State Apply](salt.md#auto-state-apply), so when finished editing `intel.dat`, run `sudo salt -C 'I@zeek:enabled:true' state.apply zeek` to sync `/opt/so/saltstack/local/salt/zeek/policy/intel/` to `/opt/so/conf/zeek/policy/intel/`. If you have a distributed deployment with separate sensor nodes and you don't run that command yourself, intel will sync to the sensor nodes at their next scheduled highstate (see [Highstate Interval](salt.md#highstate-interval)). +[Auto State Apply](salt.md#auto-state-apply) picks up changes to `intel.dat` within a few minutes. If you don't want to wait, run `sudo salt -C 'I@zeek:enabled:true' state.apply zeek` to sync `/opt/so/saltstack/local/salt/zeek/policy/intel/` to `/opt/so/conf/zeek/policy/intel/`. Either way, intel syncs to every node running Zeek, including separate sensor nodes in a distributed deployment. If you experience an error, or do not notice `/nsm/zeek/logs/current/intel.log` being generated, try having a look in `/nsm/zeek/logs/current/reporter.log` for clues. You may also want to restart Zeek after making changes by running `sudo so-zeek-restart`. @@ -137,7 +137,7 @@ The package directory should contain a valid Zeek package structure (including a zkg requires packages from git repos to be a clone of the repo. The working tree must be clean otherwise it will not install the package. `git status` will tell you if it is clean or not. -Packages are not detected by [Auto State Apply](salt.md#auto-state-apply), so after placing the package, run `sudo salt -C 'I@zeek:enabled:true' state.apply zeek` to sync the packages to the sensor nodes. The packages will be automatically installed with `zkg` each time the Zeek container starts. If you have a distributed deployment with separate sensor nodes and you don't run that command yourself, packages will sync to the sensor nodes at their next scheduled highstate (see [Highstate Interval](salt.md#highstate-interval)). +[Auto State Apply](salt.md#auto-state-apply) picks up new packages within a few minutes. If you don't want to wait, run `sudo salt -C 'I@zeek:enabled:true' state.apply zeek` to sync the packages to the sensor nodes. The packages will be automatically installed with `zkg` each time the Zeek container starts. You can verify that a custom package was installed by checking the Zeek container logs: From 340c253e65d9c7bdf0449737e5a57c3cb3f441af Mon Sep 17 00:00:00 2001 From: Josh Patterson Date: Tue, 8 Sep 2026 09:11:10 -0400 Subject: [PATCH 2/2] remote suricata and yara/strelka from table --- docs/salt.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/docs/salt.md b/docs/salt.md index 1c4fad8c..78289a77 100644 --- a/docs/salt.md +++ b/docs/salt.md @@ -52,8 +52,6 @@ Files that you create or edit by hand on the manager in any of the following dir | `/opt/so/saltstack/local/salt/elasticsearch/files/ingest/` | [Elasticsearch](elasticsearch.md) custom ingest parsers | | `/opt/so/saltstack/local/salt/elasticsearch/roles/` | [RBAC](rbac.md) custom Elastic stack role files | | `/opt/so/saltstack/local/salt/logstash/pipelines/config/custom/` | [Logstash](logstash.md) custom pipeline configuration files | -| `/opt/so/saltstack/local/salt/suricata/rules/` | [Suricata](suricata.md) rules | -| `/opt/so/saltstack/local/salt/strelka/rules/compiled/` | [Strelka](strelka.md) compiled YARA rules | Other files under `/opt/so/saltstack/local/salt/` are not watched and are picked up at the next scheduled highstate (see [Highstate Interval](#highstate-interval)). @@ -107,4 +105,4 @@ The root cause of this error is a state trying to run on a minion when another s !!! NOTE - For more information about Salt, please see . \ No newline at end of file + For more information about Salt, please see .