[Oisf-users] YAML Includes Question

[Cloherty, Sean E]

HI Peter –

Sorry for the late reply - I forgot to follow up on this.

It turned out that I had not been putting the files in the right path and then I moved the file and the filename was one character off.

Thanks,

Sean

From: Peter Manev <petermanev at gmail.com>
Sent: Sunday, September 23, 2018 11:42 AM
To: Cloherty, Sean E <scloherty at mitre.org>
Cc: oisf-users at lists.openinfosecfoundation.org
Subject: Re: [Oisf-users] YAML Includes Question



On 21 Sep 2018, at 22:47, Cloherty, Sean E <scloherty at mitre.org<mailto:scloherty at mitre.org>> wrote:
Hi –

I hope someone else has been using this feature and can lend me some advice.  I tried to break out some sections of the Suricata.yaml file and had no luck. I wanted to have the network and port variables in a separate file.  Networks change and it would be nice to just push out a new vars section by script all my servers.

I copied everything from “vars:” up to the next section and put that into its own file vars.yaml.  In suricata.yaml I put in vars: include vars.yaml in the place it had been.  That failed.


Can you please share that conf file(and the errs it subsequently generates) - I can try to help out.

Feel free to share privately  or mask out the networks - either way it’s good for me.



I’ve also tried vars: !include vars.yaml – that was in the docs, but I wasn’t clear what was being negated or why.  Either way, when I fire up Suricata (4.05) it gives all kinds of errors due to the vars not being defined.

Does the included file following the vars: head need to have the same vars: heading in it ?  Does the full path need to be part of the include statement?


Sean Cloherty
Lead InfoSec Engineer/Scientist
MITRE Corporation
office (781) 271-3707
cell      (781) 697-8043

_______________________________________________
Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org<mailto:oisf-users at openinfosecfoundation.org>
Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users

Conference: https://suricon.net
Trainings: https://suricata-ids.org/training/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20181009/196edba9/attachment.html>