[Oisf-users] YAML Includes Question

[Peter Manev]

> On 21 Sep 2018, at 22:47, Cloherty, Sean E <scloherty at mitre.org> wrote:
> 
> Hi –
>  
> I hope someone else has been using this feature and can lend me some advice.  I tried to break out some sections of the Suricata.yaml file and had no luck. I wanted to have the network and port variables in a separate file.  Networks change and it would be nice to just push out a new vars section by script all my servers.
>  
> I copied everything from “vars:” up to the next section and put that into its own file vars.yaml.  In suricata.yaml I put in vars: include vars.yaml in the place it had been.  That failed.
>  

Can you please share that conf file(and the errs it subsequently generates) - I can try to help out.

Feel free to share privately  or mask out the networks - either way it’s good for me.


> I’ve also tried vars: !include vars.yaml – that was in the docs, but I wasn’t clear what was being negated or why.  Either way, when I fire up Suricata (4.05) it gives all kinds of errors due to the vars not being defined.
>  
> Does the included file following the vars: head need to have the same vars: heading in it ?  Does the full path need to be part of the include statement?   
>  
>  
> Sean Cloherty
> Lead InfoSec Engineer/Scientist
> MITRE Corporation
> office (781) 271-3707
> cell      (781) 697-8043
>  
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> 
> Conference: https://suricon.net
> Trainings: https://suricata-ids.org/training/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20180923/19c77d97/attachment.html>