diff default ruleset for windows

threatstack · Oct 17, 2019 · 72d6b0e · 72d6b0e
1 parent f33801e
commit 72d6b0e
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/manifests/params.pp b/manifests/params.pp
@@ -48,8 +48,12 @@
     default   => '/opt/threatstack/etc'
   }
 
+  $rulesets = $facts['os']['family'] ? {
+    'Windows' => ['Windows Rule Set'],
+    default   => ['Base Rule Set']
+  }
+
   $package_version = 'installed'
-  $rulesets        = ['Base Rule Set']
   $extra_args      = undef
   $windows_install_options = ["TSDEPLOYKEY=${deploy_key}", "TSEVENTLOGLIST=Security,Microsoft-Windows-Sysmon/Operational"]