{"action":"closed","issue":{"url":"https://api.github.com/repos/dtag-dev-sec/tpotce/issues/83","repository_url":"https://api.github.com/repos/dtag-dev-sec/tpotce","labels_url":"https://api.github.com/repos/dtag-dev-sec/tpotce/issues/83/labels{/name}","comments_url":"https://api.github.com/repos/dtag-dev-sec/tpotce/issues/83/comments","events_url":"https://api.github.com/repos/dtag-dev-sec/tpotce/issues/83/events","html_url":"https://github.com/dtag-dev-sec/tpotce/issues/83","id":210851068,"number":83,"title":"Custom suricata.yaml persistence","user":{"login":"SunstriderX","id":22075120,"avatar_url":"https://avatars3.githubusercontent.com/u/22075120?v=3","gravatar_id":"","url":"https://api.github.com/users/SunstriderX","html_url":"https://github.com/SunstriderX","followers_url":"https://api.github.com/users/SunstriderX/followers","following_url":"https://api.github.com/users/SunstriderX/following{/other_user}","gists_url":"https://api.github.com/users/SunstriderX/gists{/gist_id}","starred_url":"https://api.github.com/users/SunstriderX/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SunstriderX/subscriptions","organizations_url":"https://api.github.com/users/SunstriderX/orgs","repos_url":"https://api.github.com/users/SunstriderX/repos","events_url":"https://api.github.com/users/SunstriderX/events{/privacy}","received_events_url":"https://api.github.com/users/SunstriderX/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-02-28T17:12:45Z","updated_at":"2017-03-01T13:10:44Z","closed_at":"2017-03-01T13:10:44Z","body":"Hello again :)\r\n\r\nI'm fine-tuning the config of the suricata.yaml file to fit it my needs (leaving the base config as it is to avoid messing up with the tailored solution for the T-Pot) and when I copy it inside the Suricata container and restart it, it works as I expect it to. However, when I reboot the whole host, the config is lost, and the default one is loaded.\r\nI know that for logstash if I copy a `logstash.conf` file into `/data/elk/logstash/conf/` it will be loaded into the container once it starts, however, this effect does not appear to apply to `/data/suricata/suricata.yaml` on the host. I've been trying to see if I can find where this persistence is defined, but haven't been able to.\r\nBased on the above, my question is: Is there persistence available for the suricata.yaml file? If not, can I modify the config to make it persistent? (maybe `suricata.service` ?)\r\n\r\nAs usual, thanks a lot for your time and assistance on this!"}}
{"actor":{"display_login":"SunstriderX"}}