suricata/oisf.yaml

# The default logging directory.  Any log or output file will be
# placed here if its not specified with a full path name.  This can be
# overridden with the -l command line parameter.
default-log-dir: /var/log/eidps

defrag:
  max-frags: 65535
  prealloc: yes
  timeout: 60

# Logging configuration.  This is not about logging IDS alerts, but
# IDS output about what its doing, errors, etc.
logging:

  # The default log level, can be overridden in an output section.
  default-log-level: debug

  # The default output format.  Optional parameter, should default to
  # something reasonable if not provided.  Can be overriden in an
  # output section.
  default-format: "<%t> - <%l>"

  # Default startup message.  Optional parameter, should default to
  # something reasonable if not provided.  Can be overridden in an
  # output section.
  default-startup-message: Your IDS has started.

  # A regex to filter output.  Can be overridden in an output section.
  # Defaults to empty (no filter).
  default-output-filter:

  # Configure the outputs.  If no outputs are specified the engine
  # will log to the console with an error log level.
  output:

  # Enable logging to the console.  Be a little more verbose than
  # default, log info and more critical.
  - interface: console
    log-level: info

  # Log to a file as well.  No log level specified so level will be
  # set to the default-log-level.
  - interface: file
    filename: /var/log/eidps.log

  # Log to syslog with facility local5.  Again, no level specified so
  # will level will be set to default-log-level.  We also override the
  # format as we don't want to log a timestamp, syslog will do that
  # for us.
  - interface: syslog
    facility: local5
    format: "%l"

# PF_RING configuration. for use with native PF_RING support
# for more info see http://www.ntop.org/PF_RING.html
pfring:

  # Default interface we will listen on.
  interface: eth0

  # Default clusterid.  PR_RING will load balance packets based on flow.
  # All threads/processes that will participate need to have the same
  # clusterid.
  clusterid: 99

  #Set the default rule path here to search for the files.
  #if not set, it will look at the current working dir
default-rule-path: /etc/eidps/
rule-files:
  - netbios.rules
  - x11.rules

# Holds variables that would be used by the engine.
vars:

  # Holds the address group vars that would be passed in a Signature.
  # These would be retrieved during the Signature address parsing stage.
  address-groups:

    HOME_NET: "[192.168.0.0/16,10.8.0.0/16,127.0.0.1,2001:888:13c5:5AFE::/64,2001:888:13c5:CAFE::/64]"

    EXTERNAL_NET: "[!192.168.0.0/16,2000::/3]"

    HTTP_SERVERS: "!192.168.0.0/16"

    SMTP_SERVERS: "!192.168.0.0/16"

    SQL_SERVERS: "!192.168.0.0/16"

    DNS_SERVERS: any

    TELNET_SERVERS: any

    AIM_SERVERS: any

  # Holds the port group vars that would be passed in a Signature.
  # These would be retrieved during the Signature port parsing stage.
  port-groups:

    HTTP_PORTS: "80:81,88"

    SHELLCODE_PORTS: "!80"

    ORACLE_PORTS: 1521

    SSH_PORTS: 22