Managing Configurations
Adding, updating and enabling Salem configurations.
Salem configurations are only editable from the chat interface and require users to have Salem.admin permissions.
View Configurations in Salem
Configurations are viewable from the Salem Admin menu. The Admin menu is callable by sending Salem a message in chat with the command to open the admin menu
# Send this message to Salem to retrieve the Admin Menu
view -a
From this menu, you can select configs and then choose the type of configuration you want to view.
ActionDefinition
Describes Salem integrations with thrid party APIs
ActionConf
Actions Salem can use to enrich and contextualize an alert during analysis
ParsingConf
Instructions for how to manipulate and display alert data
ReportConf
Actions Salem can take in response to it's alert analysis
FabConf
Instructions for the Salem browser extension on how Salem will recognize Alerts in different security portals
RoleConf
reserved for future use
Updating Configurations
Salem ships with many default configurations. It is common for users to directly manage ActionDefinitions to configure integrations between Salem and third-party APIs
To update a configuration, select the drop-down arrow next to a configuration and select 'update'.
You can update the configuration JSON directly, but often it's easier to copy the JSON to a text editor, make updates, and then paste the entire JSON back.
NOTE:
If you change the value of 'id', a configuration will get created with the name of the ID, and not change the configuration you originally selected.
If the JSON structure is invalid, Salem will reject the update
Last updated