mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
fe9cac5870
For SIEM analysis it is often useful to refer to the actual rules to
find out why a specific alert has been triggered when the signature
message does not convey enough information.
Turn on the new rule flag to include the rule text in eve alert output.
The feature is turned off by default.
With a rule like this:
alert dns $HOME_NET any -> 8.8.8.8 any (msg:"Google DNS server contacted"; sid:42;)
The eve alert output might look something like this (pretty-printed for
readability):
{
"timestamp": "2017-08-14T12:35:05.830812+0200",
"flow_id": 1919856770919772,
"in_iface": "eth0",
"event_type": "alert",
"src_ip": "10.20.30.40",
"src_port": 50968,
"dest_ip": "8.8.8.8",
"dest_port": 53,
"proto": "UDP",
"alert": {
"action": "allowed",
"gid": 1,
"signature_id": 42,
"rev": 0,
"signature": "Google DNS server contacted",
"category": "",
"severity": 3,
"rule": "alert dns $HOME_NET any -> 8.8.8.8 any (msg:\"Google DNS server contacted\"; sid:43;)"
},
"app_proto": "dns",
"flow": {
"pkts_toserver": 1,
"pkts_toclient": 0,
"bytes_toserver": 81,
"bytes_toclient": 0,
"start": "2017-08-14T12:35:05.830812+0200"
}
}
Feature #2020
|
7 years ago | |
|---|---|---|
| .. | ||
| _static | 7 years ago | |
| capture-hardware | 8 years ago | |
| configuration | 7 years ago | |
| file-extraction | 7 years ago | |
| licenses | 9 years ago | |
| manpages | 9 years ago | |
| output | 7 years ago | |
| partials | 7 years ago | |
| performance | 8 years ago | |
| reputation | 7 years ago | |
| rule-management | 7 years ago | |
| rules | 7 years ago | |
| setting-up-ipsinline-for-linux | 9 years ago | |
| .gitignore | 9 years ago | |
| Makefile.am | 8 years ago | |
| Makefile.sphinx | 9 years ago | |
| README.md | 9 years ago | |
| acknowledgements.rst | 7 years ago | |
| command-line-options.rst | 9 years ago | |
| conf.py | 7 years ago | |
| convert.py | 9 years ago | |
| index.rst | 7 years ago | |
| initscripts.rst | 9 years ago | |
| install.rst | 8 years ago | |
| make-sense-alerts.rst | 9 years ago | |
| public-data-sets.rst | 8 years ago | |
| setting-up-ipsinline-for-linux.rst | 9 years ago | |
| unix-socket.rst | 7 years ago | |
| what-is-suricata.rst | 9 years ago | |
README.md
Suricata User Guide
This directory contains the Suricata Guide. The Sphinx Document Generate is used to build the documentation. For a primer os reStructuredText see the reStructuredText Primer.
Development Server
To help with writing documentation there is a development web server with live reload. To get run the live server you will first need npm installed then run the following:
npm install
gulp serve
Then point your browser at http://localhost:8000/_build/html/index.html
Any edits to .rst files should trigger a "make html" and cause your browser to refresh.