mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
119 lines
3.4 KiB
YAML
119 lines
3.4 KiB
YAML
%YAML 1.1
|
|
---
|
|
|
|
# Suricata configuration file. In addition to the comments describing all
|
|
# options in this file, full documentation can be found at:
|
|
# https://docs.suricata.io/en/latest/configuration/suricata-yaml.html
|
|
|
|
# This configuration file was generated by Suricata 9.0.0-dev.
|
|
suricata-version: "9.0"
|
|
|
|
##
|
|
## Step 1: Inform Suricata about your network
|
|
##
|
|
|
|
vars:
|
|
# more specific is better for alert accuracy and performance
|
|
address-groups:
|
|
HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
|
|
#HOME_NET: "[192.168.0.0/16]"
|
|
#HOME_NET: "[10.0.0.0/8]"
|
|
#HOME_NET: "[172.16.0.0/12]"
|
|
#HOME_NET: "any"
|
|
|
|
EXTERNAL_NET: "!$HOME_NET"
|
|
#EXTERNAL_NET: "any"
|
|
|
|
HTTP_SERVERS: "$HOME_NET"
|
|
SMTP_SERVERS: "$HOME_NET"
|
|
SQL_SERVERS: "$HOME_NET"
|
|
DNS_SERVERS: "$HOME_NET"
|
|
TELNET_SERVERS: "$HOME_NET"
|
|
AIM_SERVERS: "$EXTERNAL_NET"
|
|
DC_SERVERS: "$HOME_NET"
|
|
DNP3_SERVER: "$HOME_NET"
|
|
DNP3_CLIENT: "$HOME_NET"
|
|
MODBUS_CLIENT: "$HOME_NET"
|
|
MODBUS_SERVER: "$HOME_NET"
|
|
ENIP_CLIENT: "$HOME_NET"
|
|
ENIP_SERVER: "$HOME_NET"
|
|
|
|
port-groups:
|
|
HTTP_PORTS: "80"
|
|
SHELLCODE_PORTS: "!80"
|
|
ORACLE_PORTS: 1521
|
|
SSH_PORTS: 22
|
|
DNP3_PORTS: 20000
|
|
MODBUS_PORTS: 502
|
|
FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
|
|
FTP_PORTS: 21
|
|
GENEVE_PORTS: 6081
|
|
VXLAN_PORTS: 4789
|
|
TEREDO_PORTS: 3544
|
|
SIP_PORTS: "[5060, 5061]"
|
|
|
|
##
|
|
## Step 2: Select outputs to enable
|
|
##
|
|
|
|
# Global stats configuration
|
|
stats:
|
|
enabled: yes
|
|
# The interval field (in seconds) controls the interval at
|
|
# which stats are updated in the log.
|
|
interval: 8
|
|
# Add decode events to stats.
|
|
decoder-events: true
|
|
# Decoder event prefix in stats. Has been 'decoder' before, but that leads
|
|
# to missing events in the eve.stats records. See issue #2225.
|
|
#decoder-events-prefix: "decoder.event"
|
|
# Add stream events as stats.
|
|
stream-events: true
|
|
exception-policy:
|
|
per-app-proto-errors: true # default: false. True will log errors for
|
|
# each app-proto. Warning: VERY verbose
|
|
outputs:
|
|
- eve-log:
|
|
enabled: yes
|
|
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
|
|
filename: eve.json
|
|
types:
|
|
- alert
|
|
- http:
|
|
extended: yes # enable this for extended logging information
|
|
- dns
|
|
- tls:
|
|
extended: yes # enable this for extended logging information
|
|
- files:
|
|
force-magic: no # force logging magic on all logged files
|
|
# force logging of checksums, available hash functions are md5,
|
|
# sha1 and sha256
|
|
#force-hash: [md5]
|
|
- drop:
|
|
alerts: yes # log alerts that caused drops
|
|
flows: all # start or all: 'start' logs only a single drop
|
|
verdict: yes
|
|
- stats:
|
|
totals: yes # stats for all threads merged together
|
|
threads: no # per thread stats
|
|
deltas: no # include delta values
|
|
# Don't log stats counters that are zero. Default: true
|
|
#null-values: false # False will NOT log stats counters: 0
|
|
- flow
|
|
|
|
unix-command:
|
|
enabled: auto
|
|
|
|
af-packet:
|
|
- interface: bond-dut_client
|
|
cluster-id: 1
|
|
copy-iface: bond-dut_server
|
|
- interface: bond-dut_server
|
|
cluster-id: 2
|
|
copy-iface: bond-dut_client
|
|
- interface: default
|
|
threads: 2
|
|
cluster-type: cluster_flow
|
|
copy-mode: ips
|
|
|