Skip to main content

Import Playbook Rules

Step 1: Add your ruleset​

sudo vi /opt/so/saltstack/local/pillar/global.sls
	(~line 153) soctopus:
	  playbook:
	    rulesets:
		  - your_ruleset_folder_name_here

Step 2: Restart SOCtopus​

sudo so-soctopus-restart

Step 3: Import Custom Rules into SOCtopus​

sudo docker cp your_ruleset_folder_name_here so-soctopus:/SOCtopus/sigma/rules/

Step 4: Delete Plays from Playbook Web UI​

Step 5: Update Playbook with Custom Rules​

sudo so-playbook-ruleupdate