API tools faq
paste
Guest User

Untitled

a guest
Dec 7th, 2015
697
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 63.38 KB | None | 0 0
raw download clone embed print report
  1. %YAML 1.1
  2. ---
  3.  
  4. # Suricata configuration file. In addition to the comments describing all
  5. # options in this file, full documentation can be found at:
  6. # https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml
  7.  
  8.  
  9. # Number of packets preallocated per thread. The default is 1024. A higher number
  10. # will make sure each CPU will be more easily kept busy, but may negatively
  11. # impact caching.
  12. #
  13. # If you are using the CUDA pattern matcher (mpm-algo: ac-cuda), different rules
  14. # apply. In that case try something like 60000 or more. This is because the CUDA
  15. # pattern matcher buffers and scans as many packets as possible in parallel.
  16. #max-pending-packets: 1024
  17. max-pending-packets: 65534
  18.  
  19. # Runmode the engine should use. Please check --list-runmodes to get the available
  20. # runmodes for each packet acquisition method. Defaults to "autofp" (auto flow pinned
  21. # load balancing).
  22. runmode: autofp
  23. #runmode: workers
  24.  
  25. # Specifies the kind of flow load balancer used by the flow pinned autofp mode.
  26. #
  27. # Supported schedulers are:
  28. #
  29. # round-robin - Flows assigned to threads in a round robin fashion.
  30. # active-packets - Flows assigned to threads that have the lowest number of
  31. # unprocessed packets (default).
  32. # hash - Flow alloted usihng the address hash. More of a random
  33. # technique. Was the default in Suricata 1.2.1 and older.
  34. #
  35. #autofp-scheduler: active-packets
  36.  
  37. # If suricata box is a router for the sniffed networks, set it to 'router'. If
  38. # it is a pure sniffing setup, set it to 'sniffer-only'.
  39. # If set to auto, the variable is internally switch to 'router' in IPS mode
  40. # and 'sniffer-only' in IDS mode.
  41. # This feature is currently only used by the reject* keywords.
  42. host-mode: auto
  43.  
  44. # Run suricata as user and group.
  45. #run-as:
  46. # user: suri
  47. # group: suri
  48.  
  49. # Default pid file.
  50. # Will use this file if no --pidfile in command options.
  51. #pid-file: /var/run/suricata.pid
  52.  
  53. # Daemon working directory
  54. # Suricata will change directory to this one if provided
  55. # Default: "/"
  56. #daemon-directory: "/"
  57.  
  58. # Preallocated size for packet. Default is 1514 which is the classical
  59. # size for pcap on ethernet. You should adjust this value to the highest
  60. # packet size (MTU + hardware header) on your system.
  61. #default-packet-size: 1514
  62. #default-packet-size: 1518
  63.  
  64. # The default logging directory. Any log or output file will be
  65. # placed here if its not specified with a full path name. This can be
  66. # overridden with the -l command line parameter.
  67. default-log-dir: /var/log/suricata/
  68.  
  69. # Unix command socket can be used to pass commands to suricata.
  70. # An external tool can then connect to get information from suricata
  71. # or trigger some modifications of the engine. Set enabled to yes
  72. # to activate the feature. You can use the filename variable to set
  73. # the file name of the socket.
  74. unix-command:
  75. enabled: no
  76. #filename: custom.socket
  77.  
  78. # global stats configuration
  79. stats:
  80. enabled: yes
  81. # The interval field (in seconds) controls at what interval
  82. # the loggers are invoked.
  83. interval: 8
  84.  
  85. # Configure the type of alert (and other) logging you would like.
  86. outputs:
  87.  
  88. # a line based alerts log similar to Snort's fast.log
  89. - fast:
  90. enabled: yes
  91. filename: fast.log
  92. append: yes
  93. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  94.  
  95. # Extensible Event Format (nicknamed EVE) event log in JSON format
  96. - eve-log:
  97. enabled: yes
  98. filetype: regular #regular|syslog|unix_dgram|unix_stream
  99. filename: eve.json
  100. #prefix: "@cee: " # prefix to prepend to each log entry
  101. # the following are valid when type: syslog above
  102. #identity: "suricata"
  103. #facility: local5
  104. #level: Info ## possible levels: Emergency, Alert, Critical,
  105. ## Error, Warning, Notice, Info, Debug
  106. #redis:
  107. # server: 127.0.0.1
  108. # port: 6379
  109. # mode: list ## possible values: list (default), channel
  110. # key: suricata ## key or channel to use (default to suricata)
  111. # Redis pipelining set up. This will enable to only do a query every
  112. # 'batch-size' events. This should lower the latency induced by network
  113. # connection at the cost of some memory. There is no flushing implemented
  114. # so this setting as to be reserved to high traffic suricata.
  115. # pipelining:
  116. # enabled: yes ## set enable to yes to enable query pipelining
  117. # batch-size: 10 ## number of entry to keep in buffer
  118. types:
  119. - alert:
  120. # payload: yes # enable dumping payload in Base64
  121. # payload-printable: yes # enable dumping payload in printable (lossy) format
  122. # packet: yes # enable dumping of packet (without stream segments)
  123. # http: yes # enable dumping of http fields
  124. http: yes # enable dumping of http fields
  125. # tls: yes # enable dumping of tls fields
  126. tls: yes # enable dumping of tls fields
  127. # ssh: yes # enable dumping of ssh fields
  128. ssh: yes # enable dumping of ssh fields
  129. # smtp: yes # enable dumping of smtp fields
  130.  
  131. # HTTP X-Forwarded-For support by adding an extra field or overwriting
  132. # the source or destination IP address (depending on flow direction)
  133. # with the one reported in the X-Forwarded-For HTTP header. This is
  134. # helpful when reviewing alerts for traffic that is being reverse
  135. # or forward proxied.
  136. xff:
  137. enabled: yes
  138. # Two operation modes are available, "extra-data" and "overwrite".
  139. mode: extra-data
  140. # Two proxy deployments are supported, "reverse" and "forward". In
  141. # a "reverse" deployment the IP address used is the last one, in a
  142. # "forward" deployment the first IP address is used.
  143. deployment: reverse
  144. # Header name where the actual IP address will be reported, if more
  145. # than one IP address is present, the last IP address will be the
  146. # one taken into consideration.
  147. header: X-Forwarded-For
  148. - http:
  149. extended: yes # enable this for extended logging information
  150. # custom allows additional http fields to be included in eve-log
  151. # the example below adds three additional fields when uncommented
  152. #custom: [Accept-Encoding, Accept-Language, Authorization]
  153. - dns
  154. - tls:
  155. extended: yes # enable this for extended logging information
  156. - files:
  157. force-magic: no # force logging magic on all logged files
  158. force-md5: no # force logging of md5 checksums
  159. #- drop:
  160. # alerts: no # log alerts that caused drops
  161. - smtp:
  162. #extended: yes # enable this for extended logging information
  163. # this includes: bcc, message-id, subject, x_mailer, user-agent
  164. # custom fields logging from the list:
  165. # reply-to, bcc, message-id, subject, x-mailer, user-agent, received,
  166. # x-originating-ip, in-reply-to, references, importance, priority,
  167. # sensitivity, organization, content-md5, date
  168. #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
  169. # output md5 of fields: body, subject
  170. # for the body you need to set app-layer.protocols.smtp.mime.body-md5
  171. # to yes
  172. #md5: [body, subject]
  173.  
  174. - ssh
  175. - stats:
  176. totals: yes # stats for all threads merged together
  177. threads: no # per thread stats
  178. deltas: no # include delta values
  179. # bi-directional flows
  180. #- flow
  181. # uni-directional flows
  182. #- netflow
  183.  
  184. # alert output for use with Barnyard2
  185. - unified2-alert:
  186. enabled: yes
  187. filename: unified2.alert
  188.  
  189. # File size limit. Can be specified in kb, mb, gb. Just a number
  190. # is parsed as bytes.
  191. #limit: 32mb
  192.  
  193. # Sensor ID field of unified2 alerts.
  194. #sensor-id: 0
  195.  
  196. # Include payload of packets related to alerts. Defaults to true, set to
  197. # false if payload is not required.
  198. #payload: yes
  199.  
  200. # HTTP X-Forwarded-For support by adding the unified2 extra header or
  201. # overwriting the source or destination IP address (depending on flow
  202. # direction) with the one reported in the X-Forwarded-For HTTP header.
  203. # This is helpful when reviewing alerts for traffic that is being reverse
  204. # or forward proxied.
  205. xff:
  206. enabled: no
  207. # Two operation modes are available, "extra-data" and "overwrite". Note
  208. # that in the "overwrite" mode, if the reported IP address in the HTTP
  209. # X-Forwarded-For header is of a different version of the packet
  210. # received, it will fall-back to "extra-data" mode.
  211. mode: extra-data
  212. # Two proxy deployments are supported, "reverse" and "forward". In
  213. # a "reverse" deployment the IP address used is the last one, in a
  214. # "forward" deployment the first IP address is used.
  215. deployment: reverse
  216. # Header name where the actual IP address will be reported, if more
  217. # than one IP address is present, the last IP address will be the
  218. # one taken into consideration.
  219. header: X-Forwarded-For
  220.  
  221. # a line based log of HTTP requests (no alerts)
  222. - http-log:
  223. enabled: yes
  224. filename: http.log
  225. append: yes
  226. #extended: yes # enable this for extended logging information
  227. #custom: yes # enabled the custom logging format (defined by customformat)
  228. #customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %H %m %h %u %s %B %a:%p -> %A:%P"
  229. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  230.  
  231. # a line based log of TLS handshake parameters (no alerts)
  232. - tls-log:
  233. enabled: no # Log TLS connections.
  234. filename: tls.log # File to store TLS logs.
  235. append: yes
  236. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  237. #extended: yes # Log extended information like fingerprint
  238.  
  239. # output module to store certificates chain to disk
  240. - tls-store:
  241. # enabled: no
  242. enabled: yes
  243. #certs-log-dir: certs # directory to store the certificates files
  244. certs-log-dir: certs # directory to store the certificates files
  245.  
  246. # a line based log of DNS requests and/or replies (no alerts)
  247. - dns-log:
  248. enabled: no
  249. filename: dns.log
  250. append: yes
  251. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  252.  
  253. # Packet log... log packets in pcap format. 3 modes of operation: "normal"
  254. # "multi" and "sguil".
  255. #
  256. # In normal mode a pcap file "filename" is created in the default-log-dir,
  257. # or are as specified by "dir".
  258. # In multi mode, a file is created per thread. This will perform much
  259. # better, but will create multiple files where 'normal' would create one.
  260. # In multi mode the filename takes a few special variables:
  261. # - %n -- thread number
  262. # - %i -- thread id
  263. # - %t -- timestamp (secs or secs.usecs based on 'ts-format'
  264. # E.g. filename: pcap.%n.%t
  265. #
  266. # Note that it's possible to use directories, but the directories are not
  267. # created by Suricata. E.g. filename: pcaps/%n/log.%s will log into the
  268. # per thread directory.
  269. #
  270. # Also note that the limit and max-files settings are enforced per thread.
  271. # So the size limit when using 8 threads with 1000mb files and 2000 files
  272. # is: 8*1000*2000 ~ 16TiB.
  273. #
  274. # In Sguil mode "dir" indicates the base directory. In this base dir the
  275. # pcaps are created in th directory structure Sguil expects:
  276. #
  277. # -base-dir/YYYY-MM-DD/.<timestamp>
  278. #
  279. # By default all packets are logged except:
  280. # - TCP streams beyond stream.reassembly.depth
  281. # - encrypted streams after the key exchange
  282. #
  283. - pcap-log:
  284. enabled: no
  285. filename: log.pcap
  286.  
  287. # File size limit. Can be specified in kb, mb, gb. Just a number
  288. # is parsed as bytes.
  289. limit: 1000mb
  290.  
  291. # If set to a value will enable ring buffer mode. Will keep Maximum of "max-files" of size "limit"
  292. max-files: 2000
  293.  
  294. mode: normal # normal, multi or sguil.
  295. #sguil-base-dir: /nsm_data/
  296. #ts-format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec
  297. use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets
  298. honor-pass-rules: no # If set to "yes", flows in which a pass rule matched will stopped being logged.
  299.  
  300. # a full alerts log containing much information for signature writers
  301. # or for investigating suspected false positives.
  302. - alert-debug:
  303. enabled: no
  304. filename: alert-debug.log
  305. append: yes
  306. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  307.  
  308. # alert output to prelude (http://www.prelude-technologies.com/) only
  309. # available if Suricata has been compiled with --enable-prelude
  310. - alert-prelude:
  311. enabled: no
  312. profile: suricata
  313. log-packet-content: no
  314. log-packet-header: yes
  315.  
  316. # Stats.log contains data from various counters of the suricata engine.
  317. - stats:
  318. enabled: yes
  319. filename: stats.log
  320. totals: yes # stats for all threads merged together
  321. threads: no # per thread stats
  322.  
  323. # a line based alerts log similar to fast.log into syslog
  324. - syslog:
  325. enabled: no
  326. # reported identity to syslog. If ommited the program name (usually
  327. # suricata) will be used.
  328. #identity: "suricata"
  329. facility: local5
  330. #level: Info ## possible levels: Emergency, Alert, Critical,
  331. ## Error, Warning, Notice, Info, Debug
  332.  
  333. # a line based information for dropped packets in IPS mode
  334. - drop:
  335. enabled: no
  336. filename: drop.log
  337. append: yes
  338. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  339.  
  340. # output module to store extracted files to disk
  341. #
  342. # The files are stored to the log-dir in a format "file.<id>" where <id> is
  343. # an incrementing number starting at 1. For each file "file.<id>" a meta
  344. # file "file.<id>.meta" is created.
  345. #
  346. # File extraction depends on a lot of things to be fully done:
  347. # - stream reassembly depth. For optimal results, set this to 0 (unlimited)
  348. # - http request / response body sizes. Again set to 0 for optimal results.
  349. # - rules that contain the "filestore" keyword.
  350. - file-store:
  351. # enabled: no # set to yes to enable
  352. enabled: yes # set to yes to enable
  353. log-dir: files # directory to store the files
  354. # force-magic: no # force logging magic on all stored files
  355. force-magic: yes # force logging magic on all stored files
  356. # force-md5: no # force logging of md5 checksums
  357. force-md5: yes # force logging of md5 checksums
  358. #waldo: file.waldo # waldo file to store the file_id across runs
  359.  
  360. # output module to log files tracked in a easily parsable json format
  361. - file-log:
  362. # enabled: no
  363. enabled: yes
  364. filename: files-json.log
  365. append: yes
  366. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  367.  
  368. force-magic: no # force logging magic on all logged files
  369. force-md5: no # force logging of md5 checksums
  370.  
  371. # Log TCP data after stream normalization
  372. # 2 types: file or dir. File logs into a single logfile. Dir creates
  373. # 2 files per TCP session and stores the raw TCP data into them.
  374. # Using 'both' will enable both file and dir modes.
  375. #
  376. # Note: limited by stream.depth
  377. - tcp-data:
  378. enabled: no
  379. type: file
  380. filename: tcp-data.log
  381.  
  382. # Log HTTP body data after normalization, dechunking and unzipping.
  383. # 2 types: file or dir. File logs into a single logfile. Dir creates
  384. # 2 files per HTTP session and stores the normalized data into them.
  385. # Using 'both' will enable both file and dir modes.
  386. #
  387. # Note: limited by the body limit settings
  388. - http-body-data:
  389. enabled: no
  390. type: file
  391. filename: http-data.log
  392.  
  393. # Lua Output Support - execute lua script to generate alert and event
  394. # output.
  395. # Documented at:
  396. # https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Lua_Output
  397. - lua:
  398. enabled: no
  399. #scripts-dir: /etc/suricata/lua-output/
  400. scripts:
  401. # - script1.lua
  402.  
  403. # Magic file. The extension .mgc is added to the value here.
  404. #magic-file: /usr/share/file/magic
  405. magic-file: /usr/share/file/magic
  406.  
  407. # When running in NFQ inline mode, it is possible to use a simulated
  408. # non-terminal NFQUEUE verdict.
  409. # This permit to do send all needed packet to suricata via this a rule:
  410. # iptables -I FORWARD -m mark ! --mark / -j NFQUEUE
  411. # And below, you can have your standard filtering ruleset. To activate
  412. # this mode, you need to set mode to 'repeat'
  413. # If you want packet to be sent to another queue after an ACCEPT decision
  414. # set mode to 'route' and set next-queue value.
  415. # On linux >= 3.1, you can set batchcount to a value > 1 to improve performance
  416. # by processing several packets before sending a verdict (worker runmode only).
  417. # On linux >= 3.6, you can set the fail-open option to yes to have the kernel
  418. # accept the packet if suricata is not able to keep pace.
  419. nfq:
  420. # mode: accept
  421. # repeat-mark: 1
  422. # repeat-mask: 1
  423. # route-queue: 2
  424. # batchcount: 20
  425. # fail-open: yes
  426.  
  427. #nflog support
  428. nflog:
  429. # netlink multicast group
  430. # (the same as the iptables --nflog-group param)
  431. # Group 0 is used by the kernel, so you can't use it
  432. - group: 2
  433. # netlink buffer size
  434. buffer-size: 18432
  435. # put default value here
  436. - group: default
  437. # set number of packet to queue inside kernel
  438. qthreshold: 1
  439. # set the delay before flushing packet in the queue inside kernel
  440. qtimeout: 100
  441. # netlink max buffer size
  442. max-size: 20000
  443.  
  444. # af-packet support
  445. # Set threads to > 1 to use PACKET_FANOUT support
  446. af-packet:
  447. - interface: p119p1
  448. # Number of receive threads. "auto" uses the number of cores
  449. threads: auto
  450. # Default clusterid. AF_PACKET will load balance packets based on flow.
  451. # All threads/processes that will participate need to have the same
  452. # clusterid.
  453. cluster-id: 99
  454. # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
  455. # This is only supported for Linux kernel > 3.1
  456. # possible value are:
  457. # * cluster_round_robin: round robin load balancing
  458. # * cluster_flow: all packets of a given flow are send to the same socket
  459. # * cluster_cpu: all packets treated in kernel by a CPU are send to the same socket
  460. # * cluster_qm: all packets linked by network card to a RSS queue are sent to the same
  461. # socket. Requires at least Linux 3.14.
  462. # * cluster_random: packets are sent randomly to sockets but with an equipartition.
  463. # Requires at least Linux 3.14.
  464. # * cluster_rollover: kernel rotates between sockets filling each socket before moving
  465. # to the next. Requires at least Linux 3.10.
  466. # Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system
  467. # with capture card using RSS (require cpu affinity tuning and system irq tuning)
  468. cluster-type: cluster_flow
  469. # In some fragmentation case, the hash can not be computed. If "defrag" is set
  470. # to yes, the kernel will do the needed defragmentation before sending the packets.
  471. # defrag: yes
  472. defrag: no
  473. # After Linux kernel 3.10 it is possible to activate the rollover option: if a socket is
  474. # full then kernel will send the packet on the next socket with room available. This option
  475. # can minimize packet drop and increase the treated bandwith on single intensive flow.
  476. #rollover: yes
  477. rollover: yes
  478. # To use the ring feature of AF_PACKET, set 'use-mmap' to yes
  479. use-mmap: yes
  480. # Ring size will be computed with respect to max_pending_packets and number
  481. # of threads. You can set manually the ring size in number of packets by setting
  482. # the following value. If you are using flow cluster-type and have really network
  483. # intensive single-flow you could want to set the ring-size independantly of the number
  484. # of threads:
  485. #ring-size: 2048
  486. ring-size: 200000
  487. # On busy system, this could help to set it to yes to recover from a packet drop
  488. # phase. This will result in some packets (at max a ring flush) being non treated.
  489. #use-emergency-flush: yes
  490. # recv buffer size, increase value could improve performance
  491. # buffer-size: 32768
  492. # Set to yes to disable promiscuous mode
  493. # disable-promisc: no
  494. # Choose checksum verification mode for the interface. At the moment
  495. # of the capture, some packets may be with an invalid checksum due to
  496. # offloading to the network card of the checksum computation.
  497. # Possible values are:
  498. # - kernel: use indication sent by kernel for each packet (default)
  499. # - yes: checksum validation is forced
  500. # - no: checksum validation is disabled
  501. # - auto: suricata uses a statistical approach to detect when
  502. # checksum off-loading is used.
  503. # Warning: 'checksum-validation' must be set to yes to have any validation
  504. #checksum-checks: kernel
  505. # BPF filter to apply to this interface. The pcap filter syntax apply here.
  506. #bpf-filter: port 80 or udp
  507. # You can use the following variables to activate AF_PACKET tap od IPS mode.
  508. # If copy-mode is set to ips or tap, the traffic coming to the current
  509. # interface will be copied to the copy-iface interface. If 'tap' is set, the
  510. # copy is complete. If 'ips' is set, the packet matching a 'drop' action
  511. # will not be copied.
  512. #copy-mode: ips
  513. copy-mode: ips
  514. #copy-iface: eth1
  515. copy-iface: p121p1
  516. buffer-size: 8192000000000
  517. # - interface: eth1
  518. - interface: p121p1
  519. threads: auto
  520. cluster-id: 98
  521. cluster-type: cluster_flow
  522. # defrag: yes
  523. defrag: no
  524. copy-mode: ips
  525. copy-iface: p119p1
  526. rollover: yes
  527. ring-size: 200000
  528. buffer-size: 8192000000000
  529. use-mmap: yes
  530. # buffer-size: 32768
  531. # disable-promisc: no
  532. # Put default values here
  533. - interface: default
  534. #threads: auto
  535. #use-mmap: yes
  536. #rollover: yes
  537. rollover: yes
  538.  
  539. # Netmap support
  540. #
  541. # Netmap operates with NIC directly in driver, so you need FreeBSD wich have
  542. # built-in netmap support or compile and install netmap module and appropriate
  543. # NIC driver on your Linux system.
  544. # To reach maximum throughput disable all receive-, segmentation-,
  545. # checksum- offloadings on NIC.
  546. # Disabling Tx checksum offloading is *required* for connecting OS endpoint
  547. # with NIC endpoint.
  548. # You can find more information at https://github.com/luigirizzo/netmap
  549. #
  550. netmap:
  551. # To specify OS endpoint add plus sign at the end (e.g. "eth0+")
  552. - interface: eth2
  553. # Number of receive threads. "auto" uses number of RSS queues on interface.
  554. threads: auto
  555. # You can use the following variables to activate netmap tap or IPS mode.
  556. # If copy-mode is set to ips or tap, the traffic coming to the current
  557. # interface will be copied to the copy-iface interface. If 'tap' is set, the
  558. # copy is complete. If 'ips' is set, the packet matching a 'drop' action
  559. # will not be copied.
  560. # To specify the OS as the copy-iface (so the OS can route packets, or forward
  561. # to a service running on the same machine) add a plus sign at the end
  562. # (e.g. "copy-iface: eth0+"). Don't forget to set up a symmetrical eth0+ -> eth0
  563. # for return packets. Hardware checksumming must be *off* on the interface if
  564. # using an OS endpoint (e.g. 'ifconfig eth0 -rxcsum -txcsum -rxcsum6 -txcsum6' for FreeBSD
  565. # or 'ethtool -K eth0 tx off rx off' for Linux).
  566. #copy-mode: tap
  567. #copy-iface: eth3
  568. # Set to yes to disable promiscuous mode
  569. # disable-promisc: no
  570. # Choose checksum verification mode for the interface. At the moment
  571. # of the capture, some packets may be with an invalid checksum due to
  572. # offloading to the network card of the checksum computation.
  573. # Possible values are:
  574. # - yes: checksum validation is forced
  575. # - no: checksum validation is disabled
  576. # - auto: suricata uses a statistical approach to detect when
  577. # checksum off-loading is used.
  578. # Warning: 'checksum-validation' must be set to yes to have any validation
  579. #checksum-checks: auto
  580. # BPF filter to apply to this interface. The pcap filter syntax apply here.
  581. #bpf-filter: port 80 or udp
  582. #- interface: eth3
  583. #threads: auto
  584. #copy-mode: tap
  585. #copy-iface: eth2
  586. # Put default values here
  587. - interface: default
  588.  
  589. legacy:
  590. uricontent: enabled
  591.  
  592. # You can specify a threshold config file by setting "threshold-file"
  593. # to the path of the threshold config file:
  594. threshold-file: /etc/suricata/threshold.config
  595.  
  596. # The detection engine builds internal groups of signatures. The engine
  597. # allow us to specify the profile to use for them, to manage memory on an
  598. # efficient way keeping a good performance. For the profile keyword you
  599. # can use the words "low", "medium", "high" or "custom". If you use custom
  600. # make sure to define the values at "- custom-values" as your convenience.
  601. # Usually you would prefer medium/high/low.
  602. #
  603. # "sgh mpm-context", indicates how the staging should allot mpm contexts for
  604. # the signature groups. "single" indicates the use of a single context for
  605. # all the signature group heads. "full" indicates a mpm-context for each
  606. # group head. "auto" lets the engine decide the distribution of contexts
  607. # based on the information the engine gathers on the patterns from each
  608. # group head.
  609. #
  610. # The option inspection-recursion-limit is used to limit the recursive calls
  611. # in the content inspection code. For certain payload-sig combinations, we
  612. # might end up taking too much time in the content inspection code.
  613. # If the argument specified is 0, the engine uses an internally defined
  614. # default limit. On not specifying a value, we use no limits on the recursion.
  615. detect-engine:
  616. # - profile: medium
  617. - profile: high
  618. - custom-values:
  619. toclient-src-groups: 2
  620. toclient-dst-groups: 2
  621. toclient-sp-groups: 2
  622. toclient-dp-groups: 3
  623. toserver-src-groups: 2
  624. toserver-dst-groups: 4
  625. toserver-sp-groups: 2
  626. toserver-dp-groups: 25
  627. - sgh-mpm-context: auto
  628. - inspection-recursion-limit: 3000
  629. # If set to yes, the loading of signatures will be made after the capture
  630. # is started. This will limit the downtime in IPS mode.
  631. #- delayed-detect: yes
  632. - delayed-detect: yes
  633.  
  634. # Suricata is multi-threaded. Here the threading can be influenced.
  635. threading:
  636. # On some cpu's/architectures it is beneficial to tie individual threads
  637. # to specific CPU's/CPU cores. In this case all threads are tied to CPU0,
  638. # and each extra CPU/core has one "detect" thread.
  639. #
  640. # On Intel Core2 and Nehalem CPU's enabling this will degrade performance.
  641. #
  642. set-cpu-affinity: no
  643. # Tune cpu affinity of suricata threads. Each family of threads can be bound
  644. # on specific CPUs.
  645. cpu-affinity:
  646. - management-cpu-set:
  647. # cpu: [ 0 ] # include only these cpus in affinity settings
  648. cpu: [ "all" ] # include only these cpus in affinity settings
  649. - receive-cpu-set:
  650. # cpu: [ 0 ] # include only these cpus in affinity settings
  651. cpu: [ "all" ] # include only these cpus in affinity settings
  652. - decode-cpu-set:
  653. # cpu: [ 0, 1 ]
  654. cpu: [ "all" ]
  655. mode: "balanced"
  656. - stream-cpu-set:
  657. # cpu: [ "0-1" ]
  658. cpu: [ "all" ]
  659. - detect-cpu-set:
  660. cpu: [ "all" ]
  661. mode: "exclusive" # run detect threads in these cpus
  662. # Use explicitely 3 threads and don't compute number by using
  663. # detect-thread-ratio variable:
  664. # threads: 3
  665. prio:
  666. low: [ 0 ]
  667. medium: [ "1-2" ]
  668. # high: [ 3 ]
  669. high: [ "all" ]
  670. # default: "medium"
  671. default: "high"
  672. - verdict-cpu-set:
  673. # cpu: [ 0 ]
  674. cpu: [ "all" ]
  675. prio:
  676. default: "high"
  677. - reject-cpu-set:
  678. # cpu: [ 0 ]
  679. cpu: [ "all" ]
  680. prio:
  681. default: "low"
  682. - output-cpu-set:
  683. cpu: [ "all" ]
  684. prio:
  685. default: "medium"
  686. #
  687. # By default Suricata creates one "detect" thread per available CPU/CPU core.
  688. # This setting allows controlling this behaviour. A ratio setting of 2 will
  689. # create 2 detect threads for each CPU/CPU core. So for a dual core CPU this
  690. # will result in 4 detect threads. If values below 1 are used, less threads
  691. # are created. So on a dual core CPU a setting of 0.5 results in 1 detect
  692. # thread being created. Regardless of the setting at a minimum 1 detect
  693. # thread will always be created.
  694. #
  695. detect-thread-ratio: 1.5
  696. # detect-thread-ratio: 2.5
  697.  
  698. # Cuda configuration.
  699. cuda:
  700. # The "mpm" profile. On not specifying any of these parameters, the engine's
  701. # internal default values are used, which are same as the ones specified in
  702. # in the default conf file.
  703. mpm:
  704. # The minimum length required to buffer data to the gpu.
  705. # Anything below this is MPM'ed on the CPU.
  706. # Can be specified in kb, mb, gb. Just a number indicates it's in bytes.
  707. # A value of 0 indicates there's no limit.
  708. data-buffer-size-min-limit: 0
  709. # The maximum length for data that we would buffer to the gpu.
  710. # Anything over this is MPM'ed on the CPU.
  711. # Can be specified in kb, mb, gb. Just a number indicates it's in bytes.
  712. data-buffer-size-max-limit: 1500
  713. # The ring buffer size used by the CudaBuffer API to buffer data.
  714. cudabuffer-buffer-size: 500mb
  715. # The max chunk size that can be sent to the gpu in a single go.
  716. gpu-transfer-size: 50mb
  717. # The timeout limit for batching of packets in microseconds.
  718. batching-timeout: 2000
  719. # The device to use for the mpm. Currently we don't support load balancing
  720. # on multiple gpus. In case you have multiple devices on your system, you
  721. # can specify the device to use, using this conf. By default we hold 0, to
  722. # specify the first device cuda sees. To find out device-id associated with
  723. # the card(s) on the system run "suricata --list-cuda-cards".
  724. device-id: 0
  725. # No of Cuda streams used for asynchronous processing. All values > 0 are valid.
  726. # For this option you need a device with Compute Capability > 1.0.
  727. cuda-streams: 2
  728.  
  729. # Select the multi pattern algorithm you want to run for scan/search the
  730. # in the engine. The supported algorithms are b2g, b3g, wumanber,
  731. # ac, ac-bs and ac-gfbs.
  732. #
  733. # The mpm you choose also decides the distribution of mpm contexts for
  734. # signature groups, specified by the conf - "detect-engine.sgh-mpm-context".
  735. # Selecting "ac" as the mpm would require "detect-engine.sgh-mpm-context"
  736. # to be set to "single", because of ac's memory requirements, unless the
  737. # ruleset is small enough to fit in one's memory, in which case one can
  738. # use "full" with "ac". Rest of the mpms can be run in "full" mode.
  739. #
  740. # There is also a CUDA pattern matcher (only available if Suricata was
  741. # compiled with --enable-cuda: b2g_cuda. Make sure to update your
  742. # max-pending-packets setting above as well if you use b2g_cuda.
  743.  
  744. mpm-algo: ac
  745.  
  746. # The memory settings for hash size of these algorithms can vary from lowest
  747. # (2048) - low (4096) - medium (8192) - high (16384) - higher (32768) - max
  748. # (65536). The bloomfilter sizes of these algorithms can vary from low (512) -
  749. # medium (1024) - high (2048).
  750. #
  751. # For B2g/B3g algorithms, there is a support for two different scan/search
  752. # algorithms. For B2g the scan algorithms are B2gScan & B2gScanBNDMq, and
  753. # search algorithms are B2gSearch & B2gSearchBNDMq. For B3g scan algorithms
  754. # are B3gScan & B3gScanBNDMq, and search algorithms are B3gSearch &
  755. # B3gSearchBNDMq.
  756. #
  757. # For B2g the different scan/search algorithms and, hash and bloom
  758. # filter size settings. For B3g the different scan/search algorithms and, hash
  759. # and bloom filter size settings. For wumanber the hash and bloom filter size
  760. # settings.
  761.  
  762. pattern-matcher:
  763. - b2g:
  764. search-algo: B2gSearchBNDMq
  765. hash-size: low
  766. bf-size: medium
  767. - b3g:
  768. search-algo: B3gSearchBNDMq
  769. hash-size: low
  770. bf-size: medium
  771. - wumanber:
  772. hash-size: low
  773. bf-size: medium
  774.  
  775. # Defrag settings:
  776.  
  777. defrag:
  778. # memcap: 32mb
  779. memcap: 8gb
  780. # hash-size: 65536
  781. hash-size: 6553600
  782. trackers: 65535 # number of defragmented flows to follow
  783. max-frags: 65535 # number of fragments to keep (higher than trackers)
  784. prealloc: yes
  785. timeout: 60
  786.  
  787. # Enable defrag per host settings
  788. # host-config:
  789. #
  790. # - dmz:
  791. # timeout: 30
  792. # address: [192.168.1.0/24, 127.0.0.0/8, 1.1.1.0/24, 2.2.2.0/24, "1.1.1.1", "2.2.2.2", "::1"]
  793. #
  794. # - lan:
  795. # timeout: 45
  796. # address:
  797. # - 192.168.0.0/24
  798. # - 192.168.10.0/24
  799. # - 172.16.14.0/24
  800.  
  801. # Flow settings:
  802. # By default, the reserved memory (memcap) for flows is 32MB. This is the limit
  803. # for flow allocation inside the engine. You can change this value to allow
  804. # more memory usage for flows.
  805. # The hash-size determine the size of the hash used to identify flows inside
  806. # the engine, and by default the value is 65536.
  807. # At the startup, the engine can preallocate a number of flows, to get a better
  808. # performance. The number of flows preallocated is 10000 by default.
  809. # emergency-recovery is the percentage of flows that the engine need to
  810. # prune before unsetting the emergency state. The emergency state is activated
  811. # when the memcap limit is reached, allowing to create new flows, but
  812. # prunning them with the emergency timeouts (they are defined below).
  813. # If the memcap is reached, the engine will try to prune flows
  814. # with the default timeouts. If it doens't find a flow to prune, it will set
  815. # the emergency bit and it will try again with more agressive timeouts.
  816. # If that doesn't work, then it will try to kill the last time seen flows
  817. # not in use.
  818. # The memcap can be specified in kb, mb, gb. Just a number indicates it's
  819. # in bytes.
  820.  
  821. flow:
  822. # memcap: 64mb
  823. memcap: 16gb
  824. # hash-size: 65536
  825. hash-size: 10485760
  826. prealloc: 10000
  827. # prealloc: 20000
  828. # prealloc: 4000000
  829. # prealloc: 10485760
  830. emergency-recovery: 30
  831. #managers: 1 # default to one flow manager
  832. #recyclers: 1 # default to one flow recycler thread
  833.  
  834. # This option controls the use of vlan ids in the flow (and defrag)
  835. # hashing. Normally this should be enabled, but in some (broken)
  836. # setups where both sides of a flow are not tagged with the same vlan
  837. # tag, we can ignore the vlan id's in the flow hashing.
  838. vlan:
  839. use-for-tracking: true
  840.  
  841. # Specific timeouts for flows. Here you can specify the timeouts that the
  842. # active flows will wait to transit from the current state to another, on each
  843. # protocol. The value of "new" determine the seconds to wait after a hanshake or
  844. # stream startup before the engine free the data of that flow it doesn't
  845. # change the state to established (usually if we don't receive more packets
  846. # of that flow). The value of "established" is the amount of
  847. # seconds that the engine will wait to free the flow if it spend that amount
  848. # without receiving new packets or closing the connection. "closed" is the
  849. # amount of time to wait after a flow is closed (usually zero).
  850. #
  851. # There's an emergency mode that will become active under attack circumstances,
  852. # making the engine to check flow status faster. This configuration variables
  853. # use the prefix "emergency-" and work similar as the normal ones.
  854. # Some timeouts doesn't apply to all the protocols, like "closed", for udp and
  855. # icmp.
  856.  
  857. flow-timeouts:
  858.  
  859. default:
  860. new: 30
  861. established: 300
  862. closed: 0
  863. emergency-new: 10
  864. emergency-established: 100
  865. emergency-closed: 0
  866. tcp:
  867. new: 60
  868. established: 3600
  869. closed: 120
  870. emergency-new: 10
  871. emergency-established: 300
  872. emergency-closed: 20
  873. udp:
  874. new: 30
  875. established: 300
  876. emergency-new: 10
  877. emergency-established: 100
  878. icmp:
  879. new: 30
  880. established: 300
  881. emergency-new: 10
  882. emergency-established: 100
  883.  
  884. # Stream engine settings. Here the TCP stream tracking and reassembly
  885. # engine is configured.
  886. #
  887. # stream:
  888. # memcap: 32mb # Can be specified in kb, mb, gb. Just a
  889. # # number indicates it's in bytes.
  890. # checksum-validation: yes # To validate the checksum of received
  891. # # packet. If csum validation is specified as
  892. # # "yes", then packet with invalid csum will not
  893. # # be processed by the engine stream/app layer.
  894. # # Warning: locally generated trafic can be
  895. # # generated without checksum due to hardware offload
  896. # # of checksum. You can control the handling of checksum
  897. # # on a per-interface basis via the 'checksum-checks'
  898. # # option
  899. # prealloc-sessions: 2k # 2k sessions prealloc'd per stream thread
  900. # midstream: false # don't allow midstream session pickups
  901. # async-oneside: false # don't enable async stream handling
  902. # inline: no # stream inline mode
  903. # max-synack-queued: 5 # Max different SYN/ACKs to queue
  904. #
  905. # reassembly:
  906. # memcap: 64mb # Can be specified in kb, mb, gb. Just a number
  907. # # indicates it's in bytes.
  908. # depth: 1mb # Can be specified in kb, mb, gb. Just a number
  909. # # indicates it's in bytes.
  910. # toserver-chunk-size: 2560 # inspect raw stream in chunks of at least
  911. # # this size. Can be specified in kb, mb,
  912. # # gb. Just a number indicates it's in bytes.
  913. # # The max acceptable size is 4024 bytes.
  914. # toclient-chunk-size: 2560 # inspect raw stream in chunks of at least
  915. # # this size. Can be specified in kb, mb,
  916. # # gb. Just a number indicates it's in bytes.
  917. # # The max acceptable size is 4024 bytes.
  918. # randomize-chunk-size: yes # Take a random value for chunk size around the specified value.
  919. # # This lower the risk of some evasion technics but could lead
  920. # # detection change between runs. It is set to 'yes' by default.
  921. # randomize-chunk-range: 10 # If randomize-chunk-size is active, the value of chunk-size is
  922. # # a random value between (1 - randomize-chunk-range/100)*randomize-chunk-size
  923. # # and (1 + randomize-chunk-range/100)*randomize-chunk-size. Default value
  924. # # of randomize-chunk-range is 10.
  925. #
  926. # raw: yes # 'Raw' reassembly enabled or disabled.
  927. # # raw is for content inspection by detection
  928. # # engine.
  929. #
  930. # chunk-prealloc: 250 # Number of preallocated stream chunks. These
  931. # # are used during stream inspection (raw).
  932. # segments: # Settings for reassembly segment pool.
  933. # - size: 4 # Size of the (data)segment for a pool
  934. # prealloc: 256 # Number of segments to prealloc and keep
  935. # # in the pool.
  936. # zero-copy-size: 128 # This option sets in bytes the value at
  937. # # which segment data is passed to the app
  938. # # layer API directly. Data sizes equal to
  939. # # and higher than the value set are passed
  940. # # on directly.
  941. #
  942. stream:
  943. # memcap: 32mb
  944. memcap: 256gb
  945. checksum-validation: yes # reject wrong csums
  946. inline: auto # auto will use inline mode in IPS mode, yes or no set it statically
  947. reassembly:
  948. # memcap: 128mb
  949. memcap: 512gb
  950. # depth: 1mb # reassemble 1mb into a stream
  951. depth: 0 # reassemble 1mb into a stream
  952. toserver-chunk-size: 2560
  953. toclient-chunk-size: 2560
  954. randomize-chunk-size: yes
  955. #randomize-chunk-range: 10
  956. #raw: yes
  957. #chunk-prealloc: 250
  958. #segments:
  959. # - size: 4
  960. # prealloc: 256
  961. # - size: 16
  962. # prealloc: 512
  963. # - size: 112
  964. # prealloc: 512
  965. # - size: 248
  966. # prealloc: 512
  967. # - size: 512
  968. # prealloc: 512
  969. # - size: 768
  970. # prealloc: 1024
  971. # - size: 1448
  972. # prealloc: 1024
  973. # - size: 65535
  974. # prealloc: 128
  975. #zero-copy-size: 128
  976.  
  977. # Host table:
  978. #
  979. # Host table is used by tagging and per host thresholding subsystems.
  980. #
  981. host:
  982. hash-size: 4096
  983. prealloc: 1000
  984. memcap: 16777216
  985.  
  986. # IP Pair table:
  987. #
  988. # Used by xbits 'ippair' tracking.
  989. #
  990. #ippair:
  991. # hash-size: 4096
  992. # prealloc: 1000
  993. # memcap: 16777216
  994.  
  995. # Logging configuration. This is not about logging IDS alerts, but
  996. # IDS output about what its doing, errors, etc.
  997. logging:
  998.  
  999. # The default log level, can be overridden in an output section.
  1000. # Note that debug level logging will only be emitted if Suricata was
  1001. # compiled with the --enable-debug configure option.
  1002. #
  1003. # This value is overriden by the SC_LOG_LEVEL env var.
  1004. default-log-level: notice
  1005.  
  1006. # The default output format. Optional parameter, should default to
  1007. # something reasonable if not provided. Can be overriden in an
  1008. # output section. You can leave this out to get the default.
  1009. #
  1010. # This value is overriden by the SC_LOG_FORMAT env var.
  1011. #default-log-format: "[%i] %t - (%f:%l) <%d> (%n) -- "
  1012.  
  1013. # A regex to filter output. Can be overridden in an output section.
  1014. # Defaults to empty (no filter).
  1015. #
  1016. # This value is overriden by the SC_LOG_OP_FILTER env var.
  1017. default-output-filter:
  1018.  
  1019. # Define your logging outputs. If none are defined, or they are all
  1020. # disabled you will get the default - console output.
  1021. outputs:
  1022. - console:
  1023. enabled: yes
  1024. # type: json
  1025. - file:
  1026. # enabled: no
  1027. enabled: yes
  1028. filename: /var/log/suricata.log
  1029. # type: json
  1030. - syslog:
  1031. enabled: no
  1032. facility: local5
  1033. format: "[%i] <%d> -- "
  1034. # type: json
  1035.  
  1036. # Tilera mpipe configuration. for use on Tilera TILE-Gx.
  1037. mpipe:
  1038.  
  1039. # Load balancing modes: "static", "dynamic", "sticky", or "round-robin".
  1040. load-balance: dynamic
  1041.  
  1042. # Number of Packets in each ingress packet queue. Must be 128, 512, 2028 or 65536
  1043. iqueue-packets: 2048
  1044.  
  1045. # List of interfaces we will listen on.
  1046. inputs:
  1047. - interface: xgbe2
  1048. - interface: xgbe3
  1049. - interface: xgbe4
  1050.  
  1051.  
  1052. # Relative weight of memory for packets of each mPipe buffer size.
  1053. stack:
  1054. size128: 0
  1055. size256: 9
  1056. size512: 0
  1057. size1024: 0
  1058. size1664: 7
  1059. size4096: 0
  1060. size10386: 0
  1061. size16384: 0
  1062.  
  1063. # PF_RING configuration. for use with native PF_RING support
  1064. # for more info see http://www.ntop.org/products/pf_ring/
  1065. pfring:
  1066. - interface: eth0
  1067. # Number of receive threads (>1 will enable experimental flow pinned
  1068. # runmode)
  1069. threads: 1
  1070.  
  1071. # Default clusterid. PF_RING will load balance packets based on flow.
  1072. # All threads/processes that will participate need to have the same
  1073. # clusterid.
  1074. cluster-id: 99
  1075.  
  1076. # Default PF_RING cluster type. PF_RING can load balance per flow.
  1077. # Possible values are cluster_flow or cluster_round_robin.
  1078. cluster-type: cluster_flow
  1079. # bpf filter for this interface
  1080. #bpf-filter: tcp
  1081. # Choose checksum verification mode for the interface. At the moment
  1082. # of the capture, some packets may be with an invalid checksum due to
  1083. # offloading to the network card of the checksum computation.
  1084. # Possible values are:
  1085. # - rxonly: only compute checksum for packets received by network card.
  1086. # - yes: checksum validation is forced
  1087. # - no: checksum validation is disabled
  1088. # - auto: suricata uses a statistical approach to detect when
  1089. # checksum off-loading is used. (default)
  1090. # Warning: 'checksum-validation' must be set to yes to have any validation
  1091. #checksum-checks: auto
  1092. # Second interface
  1093. #- interface: eth1
  1094. # threads: 3
  1095. # cluster-id: 93
  1096. # cluster-type: cluster_flow
  1097. # Put default values here
  1098. - interface: default
  1099. #threads: 2
  1100.  
  1101. pcap:
  1102. - interface: eth0
  1103. # On Linux, pcap will try to use mmaped capture and will use buffer-size
  1104. # as total of memory used by the ring. So set this to something bigger
  1105. # than 1% of your bandwidth.
  1106. #buffer-size: 16777216
  1107. #bpf-filter: "tcp and port 25"
  1108. # Choose checksum verification mode for the interface. At the moment
  1109. # of the capture, some packets may be with an invalid checksum due to
  1110. # offloading to the network card of the checksum computation.
  1111. # Possible values are:
  1112. # - yes: checksum validation is forced
  1113. # - no: checksum validation is disabled
  1114. # - auto: suricata uses a statistical approach to detect when
  1115. # checksum off-loading is used. (default)
  1116. # Warning: 'checksum-validation' must be set to yes to have any validation
  1117. #checksum-checks: auto
  1118. # With some accelerator cards using a modified libpcap (like myricom), you
  1119. # may want to have the same number of capture threads as the number of capture
  1120. # rings. In this case, set up the threads variable to N to start N threads
  1121. # listening on the same interface.
  1122. #threads: 16
  1123. # set to no to disable promiscuous mode:
  1124. #promisc: no
  1125. # set snaplen, if not set it defaults to MTU if MTU can be known
  1126. # via ioctl call and to full capture if not.
  1127. #snaplen: 1518
  1128. # Put default values here
  1129. - interface: default
  1130. #checksum-checks: auto
  1131.  
  1132. pcap-file:
  1133. # Possible values are:
  1134. # - yes: checksum validation is forced
  1135. # - no: checksum validation is disabled
  1136. # - auto: suricata uses a statistical approach to detect when
  1137. # checksum off-loading is used. (default)
  1138. # Warning: 'checksum-validation' must be set to yes to have checksum tested
  1139. checksum-checks: auto
  1140.  
  1141. # For FreeBSD ipfw(8) divert(4) support.
  1142. # Please make sure you have ipfw_load="YES" and ipdivert_load="YES"
  1143. # in /etc/loader.conf or kldload'ing the appropriate kernel modules.
  1144. # Additionally, you need to have an ipfw rule for the engine to see
  1145. # the packets from ipfw. For Example:
  1146. #
  1147. # ipfw add 100 divert 8000 ip from any to any
  1148. #
  1149. # The 8000 above should be the same number you passed on the command
  1150. # line, i.e. -d 8000
  1151. #
  1152. ipfw:
  1153.  
  1154. # Reinject packets at the specified ipfw rule number. This config
  1155. # option is the ipfw rule number AT WHICH rule processing continues
  1156. # in the ipfw processing system after the engine has finished
  1157. # inspecting the packet for acceptance. If no rule number is specified,
  1158. # accepted packets are reinjected at the divert rule which they entered
  1159. # and IPFW rule processing continues. No check is done to verify
  1160. # this will rule makes sense so care must be taken to avoid loops in ipfw.
  1161. #
  1162. ## The following example tells the engine to reinject packets
  1163. # back into the ipfw firewall AT rule number 5500:
  1164. #
  1165. # ipfw-reinjection-rule-number: 5500
  1166.  
  1167. # Set the default rule path here to search for the files.
  1168. # if not set, it will look at the current working dir
  1169. default-rule-path: /etc/suricata/rules
  1170. rule-files:
  1171. # - botcc.rules
  1172. # - ciarmy.rules
  1173. # - compromised.rules
  1174. # - drop.rules
  1175. # - dshield.rules
  1176. # - emerging-activex.rules
  1177. # - emerging-attack_response.rules
  1178. # - emerging-chat.rules
  1179. # - emerging-current_events.rules
  1180. # - emerging-dns.rules
  1181. # - emerging-dos.rules
  1182. # - emerging-exploit.rules
  1183. # - emerging-ftp.rules
  1184. # - emerging-games.rules
  1185. # - emerging-icmp_info.rules
  1186. ## - emerging-icmp.rules
  1187. # - emerging-imap.rules
  1188. # - emerging-inappropriate.rules
  1189. # - emerging-malware.rules
  1190. # - emerging-misc.rules
  1191. # - emerging-mobile_malware.rules
  1192. # - emerging-netbios.rules
  1193. # - emerging-p2p.rules
  1194. # - emerging-policy.rules
  1195. # - emerging-pop3.rules
  1196. # - emerging-rpc.rules
  1197. # - emerging-scada.rules
  1198. # - emerging-scan.rules
  1199. # - emerging-shellcode.rules
  1200. # - emerging-smtp.rules
  1201. # - emerging-snmp.rules
  1202. # - emerging-sql.rules
  1203. # - emerging-telnet.rules
  1204. # - emerging-tftp.rules
  1205. # - emerging-trojan.rules
  1206. # - emerging-user_agents.rules
  1207. # - emerging-voip.rules
  1208. # - emerging-web_client.rules
  1209. # - emerging-web_server.rules
  1210. # - emerging-web_specific_apps.rules
  1211. # - emerging-worm.rules
  1212. # - tor.rules
  1213. # - decoder-events.rules # available in suricata sources under rules dir
  1214. # - stream-events.rules # available in suricata sources under rules dir
  1215. # - http-events.rules # available in suricata sources under rules dir
  1216. # - smtp-events.rules # available in suricata sources under rules dir
  1217. # - dns-events.rules # available in suricata sources under rules dir
  1218. # - tls-events.rules # available in suricata sources under rules dir
  1219. # - modbus-events.rules # available in suricata sources under rules dir
  1220. # - app-layer-events.rules # available in suricata sources under rules dir
  1221. - emerging.rules
  1222. - suri-local.rules
  1223.  
  1224. classification-file: /etc/suricata/classification.config
  1225. reference-config-file: /etc/suricata/reference.config
  1226.  
  1227. # Holds variables that would be used by the engine.
  1228. vars:
  1229.  
  1230. # Holds the address group vars that would be passed in a Signature.
  1231. # These would be retrieved during the Signature address parsing stage.
  1232. address-groups:
  1233.  
  1234. HOME_NET: "[221.126.40.202,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
  1235.  
  1236. EXTERNAL_NET: "!$HOME_NET"
  1237.  
  1238. HTTP_SERVERS: "$HOME_NET"
  1239.  
  1240. SMTP_SERVERS: "$HOME_NET"
  1241.  
  1242. SQL_SERVERS: "$HOME_NET"
  1243.  
  1244. DNS_SERVERS: "$HOME_NET"
  1245.  
  1246. TELNET_SERVERS: "$HOME_NET"
  1247.  
  1248. AIM_SERVERS: "$EXTERNAL_NET"
  1249.  
  1250. DNP3_SERVER: "$HOME_NET"
  1251.  
  1252. DNP3_CLIENT: "$HOME_NET"
  1253.  
  1254. MODBUS_CLIENT: "$HOME_NET"
  1255.  
  1256. MODBUS_SERVER: "$HOME_NET"
  1257.  
  1258. ENIP_CLIENT: "$HOME_NET"
  1259.  
  1260. ENIP_SERVER: "$HOME_NET"
  1261.  
  1262. # Holds the port group vars that would be passed in a Signature.
  1263. # These would be retrieved during the Signature port parsing stage.
  1264. port-groups:
  1265.  
  1266. HTTP_PORTS: "80"
  1267.  
  1268. SHELLCODE_PORTS: "!80"
  1269.  
  1270. ORACLE_PORTS: 1521
  1271.  
  1272. SSH_PORTS: 22
  1273.  
  1274. DNP3_PORTS: 20000
  1275.  
  1276. MODBUS_PORTS: 502
  1277.  
  1278. # Set the order of alerts bassed on actions
  1279. # The default order is pass, drop, reject, alert
  1280. # action-order:
  1281. # - pass
  1282. # - drop
  1283. # - reject
  1284. # - alert
  1285.  
  1286. # IP Reputation
  1287. #reputation-categories-file: /etc/suricata/iprep/categories.txt
  1288. #default-reputation-path: /etc/suricata/iprep
  1289. #reputation-files:
  1290. # - reputation.list
  1291.  
  1292. # IP Reputation
  1293. reputation-categories-file: /etc/suricata/iprep_categories
  1294. default-reputation-path: /etc/suricata/rules/iprep
  1295. reputation-files:
  1296. - ip-filter.blacklist
  1297. - openbl.blacklist
  1298. - blocklist.de.blacklist
  1299. - sslip.blacklist
  1300. - ip-finder.blacklist
  1301. - denyhosts.bitwash.blacklist
  1302. - denyhosts.sync.blacklist
  1303.  
  1304. # Host specific policies for defragmentation and TCP stream
  1305. # reassembly. The host OS lookup is done using a radix tree, just
  1306. # like a routing table so the most specific entry matches.
  1307. host-os-policy:
  1308. # Make the default policy windows.
  1309. windows: [0.0.0.0/0]
  1310. bsd: []
  1311. bsd-right: []
  1312. old-linux: []
  1313. linux: [10.0.0.0/8, 192.168.1.100, "8762:2352:6241:7245:E000:0000:0000:0000"]
  1314. old-solaris: []
  1315. solaris: ["::1"]
  1316. hpux10: []
  1317. hpux11: []
  1318. irix: []
  1319. macos: []
  1320. vista: []
  1321. windows2k3: []
  1322.  
  1323.  
  1324. # Limit for the maximum number of asn1 frames to decode (default 256)
  1325. asn1-max-frames: 256
  1326.  
  1327. # When run with the option --engine-analysis, the engine will read each of
  1328. # the parameters below, and print reports for each of the enabled sections
  1329. # and exit. The reports are printed to a file in the default log dir
  1330. # given by the parameter "default-log-dir", with engine reporting
  1331. # subsection below printing reports in its own report file.
  1332. engine-analysis:
  1333. # enables printing reports for fast-pattern for every rule.
  1334. rules-fast-pattern: yes
  1335. # enables printing reports for each rule
  1336. rules: yes
  1337.  
  1338. #recursion and match limits for PCRE where supported
  1339. pcre:
  1340. match-limit: 3500
  1341. match-limit-recursion: 1500
  1342.  
  1343. # Holds details on the app-layer. The protocols section details each protocol.
  1344. # Under each protocol, the default value for detection-enabled and "
  1345. # parsed-enabled is yes, unless specified otherwise.
  1346. # Each protocol covers enabling/disabling parsers for all ipprotos
  1347. # the app-layer protocol runs on. For example "dcerpc" refers to the tcp
  1348. # version of the protocol as well as the udp version of the protocol.
  1349. # The option "enabled" takes 3 values - "yes", "no", "detection-only".
  1350. # "yes" enables both detection and the parser, "no" disables both, and
  1351. # "detection-only" enables detection only(parser disabled).
  1352. app-layer:
  1353. protocols:
  1354. tls:
  1355. enabled: yes
  1356. detection-ports:
  1357. dp: 443
  1358.  
  1359. #no-reassemble: yes
  1360. dcerpc:
  1361. enabled: yes
  1362. ftp:
  1363. enabled: yes
  1364. ssh:
  1365. enabled: yes
  1366. smtp:
  1367. enabled: yes
  1368. # Configure SMTP-MIME Decoder
  1369. mime:
  1370. # Decode MIME messages from SMTP transactions
  1371. # (may be resource intensive)
  1372. # This field supercedes all others because it turns the entire
  1373. # process on or off
  1374. decode-mime: yes
  1375.  
  1376. # Decode MIME entity bodies (ie. base64, quoted-printable, etc.)
  1377. decode-base64: yes
  1378. decode-quoted-printable: yes
  1379.  
  1380. # Maximum bytes per header data value stored in the data structure
  1381. # (default is 2000)
  1382. header-value-depth: 2000
  1383.  
  1384. # Extract URLs and save in state data structure
  1385. extract-urls: yes
  1386. # Set to yes to compute the md5 of the mail body. You will then
  1387. # be able to journalize it.
  1388. body-md5: no
  1389. # Configure inspected-tracker for file_data keyword
  1390. inspected-tracker:
  1391. content-limit: 1000
  1392. content-inspect-min-size: 1000
  1393. content-inspect-window: 1000
  1394. imap:
  1395. enabled: detection-only
  1396. msn:
  1397. enabled: detection-only
  1398. smb:
  1399. enabled: yes
  1400. detection-ports:
  1401. dp: 139
  1402. # Note: Modbus probe parser is minimalist due to the poor significant field
  1403. # Only Modbus message length (greater than Modbus header length)
  1404. # And Protocol ID (equal to 0) are checked in probing parser
  1405. # It is important to enable detection port and define Modbus port
  1406. # to avoid false positive
  1407. modbus:
  1408. # How many unreplied Modbus requests are considered a flood.
  1409. # If the limit is reached, app-layer-event:modbus.flooded; will match.
  1410. #request-flood: 500
  1411.  
  1412. enabled: yes
  1413. detection-ports:
  1414. dp: 502
  1415. # According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it
  1416. # is recommended to keep the TCP connection opened with a remote device
  1417. # and not to open and close it for each MODBUS/TCP transaction. In that
  1418. # case, it is important to set the depth of the stream reassembling as
  1419. # unlimited (stream.reassembly.depth: 0)
  1420. # smb2 detection is disabled internally inside the engine.
  1421. #smb2:
  1422. # enabled: yes
  1423. dns:
  1424. # memcaps. Globally and per flow/state.
  1425. #global-memcap: 16mb
  1426. #state-memcap: 512kb
  1427.  
  1428. # How many unreplied DNS requests are considered a flood.
  1429. # If the limit is reached, app-layer-event:dns.flooded; will match.
  1430. #request-flood: 500
  1431.  
  1432. tcp:
  1433. enabled: yes
  1434. detection-ports:
  1435. dp: 53
  1436. udp:
  1437. enabled: yes
  1438. detection-ports:
  1439. dp: 53
  1440. http:
  1441. enabled: yes
  1442. # memcap: 64mb
  1443.  
  1444. ###########################################################################
  1445. # Configure libhtp.
  1446. #
  1447. #
  1448. # default-config: Used when no server-config matches
  1449. # personality: List of personalities used by default
  1450. # request-body-limit: Limit reassembly of request body for inspection
  1451. # by http_client_body & pcre /P option.
  1452. # response-body-limit: Limit reassembly of response body for inspection
  1453. # by file_data, http_server_body & pcre /Q option.
  1454. # double-decode-path: Double decode path section of the URI
  1455. # double-decode-query: Double decode query section of the URI
  1456. #
  1457. # server-config: List of server configurations to use if address matches
  1458. # address: List of ip addresses or networks for this block
  1459. # personalitiy: List of personalities used by this block
  1460. # request-body-limit: Limit reassembly of request body for inspection
  1461. # by http_client_body & pcre /P option.
  1462. # response-body-limit: Limit reassembly of response body for inspection
  1463. # by file_data, http_server_body & pcre /Q option.
  1464. # double-decode-path: Double decode path section of the URI
  1465. # double-decode-query: Double decode query section of the URI
  1466. #
  1467. # uri-include-all: Include all parts of the URI. By default the
  1468. # 'scheme', username/password, hostname and port
  1469. # are excluded. Setting this option to true adds
  1470. # all of them to the normalized uri as inspected
  1471. # by http_uri, urilen, pcre with /U and the other
  1472. # keywords that inspect the normalized uri.
  1473. # Note that this does not affect http_raw_uri.
  1474. # Also, note that including all was the default in
  1475. # 1.4 and 2.0beta1.
  1476. #
  1477. # meta-field-limit: Hard size limit for request and response size
  1478. # limits. Applies to request line and headers,
  1479. # response line and headers. Does not apply to
  1480. # request or response bodies. Default is 18k.
  1481. # If this limit is reached an event is raised.
  1482. #
  1483. # Currently Available Personalities:
  1484. # Minimal
  1485. # Generic
  1486. # IDS (default)
  1487. # IIS_4_0
  1488. # IIS_5_0
  1489. # IIS_5_1
  1490. # IIS_6_0
  1491. # IIS_7_0
  1492. # IIS_7_5
  1493. # Apache_2
  1494. ###########################################################################
  1495. libhtp:
  1496.  
  1497. default-config:
  1498. personality: IDS
  1499.  
  1500. # Can be specified in kb, mb, gb. Just a number indicates
  1501. # it's in bytes.
  1502. # request-body-limit: 3072
  1503. request-body-limit: 0
  1504. # response-body-limit: 3072
  1505. response-body-limit: 0
  1506.  
  1507. # inspection limits
  1508. request-body-minimal-inspect-size: 32kb
  1509. request-body-inspect-window: 4kb
  1510. # response-body-minimal-inspect-size: 32kb
  1511. response-body-minimal-inspect-size: 65kb
  1512. # response-body-inspect-window: 4kb
  1513. response-body-inspect-window: 65kb
  1514.  
  1515. # auto will use http-body-inline mode in IPS mode, yes or no set it statically
  1516. http-body-inline: auto
  1517.  
  1518. # Take a random value for inspection sizes around the specified value.
  1519. # This lower the risk of some evasion technics but could lead
  1520. # detection change between runs. It is set to 'yes' by default.
  1521. #randomize-inspection-sizes: yes
  1522. # If randomize-inspection-sizes is active, the value of various
  1523. # inspection size will be choosen in the [1 - range%, 1 + range%]
  1524. # range
  1525. # Default value of randomize-inspection-range is 10.
  1526. #randomize-inspection-range: 10
  1527.  
  1528. # decoding
  1529. double-decode-path: no
  1530. double-decode-query: no
  1531.  
  1532. server-config:
  1533.  
  1534. #- apache:
  1535. # address: [192.168.1.0/24, 127.0.0.0/8, "::1"]
  1536. # personality: Apache_2
  1537. # # Can be specified in kb, mb, gb. Just a number indicates
  1538. # # it's in bytes.
  1539. # request-body-limit: 4096
  1540. # response-body-limit: 4096
  1541. # double-decode-path: no
  1542. # double-decode-query: no
  1543.  
  1544. #- iis7:
  1545. # address:
  1546. # - 192.168.0.0/24
  1547. # - 192.168.10.0/24
  1548. # personality: IIS_7_0
  1549. # # Can be specified in kb, mb, gb. Just a number indicates
  1550. # # it's in bytes.
  1551. # request-body-limit: 4096
  1552. # response-body-limit: 4096
  1553. # double-decode-path: no
  1554. # double-decode-query: no
  1555.  
  1556. # Profiling settings. Only effective if Suricata has been built with the
  1557. # the --enable-profiling configure flag.
  1558. #
  1559. profiling:
  1560. # Run profiling for every xth packet. The default is 1, which means we
  1561. # profile every packet. If set to 1000, one packet is profiled for every
  1562. # 1000 received.
  1563. #sample-rate: 1000
  1564.  
  1565. # rule profiling
  1566. rules:
  1567.  
  1568. # Profiling can be disabled here, but it will still have a
  1569. # performance impact if compiled in.
  1570. enabled: yes
  1571. filename: rule_perf.log
  1572. append: yes
  1573.  
  1574. # Sort options: ticks, avgticks, checks, matches, maxticks
  1575. sort: avgticks
  1576.  
  1577. # Limit the number of items printed at exit (ignored for json).
  1578. limit: 100
  1579.  
  1580. # output to json
  1581. json: true
  1582.  
  1583. # per keyword profiling
  1584. keywords:
  1585. enabled: yes
  1586. filename: keyword_perf.log
  1587. append: yes
  1588.  
  1589. # packet profiling
  1590. packets:
  1591.  
  1592. # Profiling can be disabled here, but it will still have a
  1593. # performance impact if compiled in.
  1594. enabled: yes
  1595. filename: packet_stats.log
  1596. append: yes
  1597.  
  1598. # per packet csv output
  1599. csv:
  1600.  
  1601. # Output can be disabled here, but it will still have a
  1602. # performance impact if compiled in.
  1603. enabled: no
  1604. filename: packet_stats.csv
  1605.  
  1606. # profiling of locking. Only available when Suricata was built with
  1607. # --enable-profiling-locks.
  1608. locks:
  1609. enabled: no
  1610. filename: lock_stats.log
  1611. append: yes
  1612.  
  1613. pcap-log:
  1614. enabled: no
  1615. filename: pcaplog_stats.log
  1616. append: yes
  1617.  
  1618. # Suricata core dump configuration. Limits the size of the core dump file to
  1619. # approximately max-dump. The actual core dump size will be a multiple of the
  1620. # page size. Core dumps that would be larger than max-dump are truncated. On
  1621. # Linux, the actual core dump size may be a few pages larger than max-dump.
  1622. # Setting max-dump to 0 disables core dumping.
  1623. # Setting max-dump to 'unlimited' will give the full core dump file.
  1624. # On 32-bit Linux, a max-dump value >= ULONG_MAX may cause the core dump size
  1625. # to be 'unlimited'.
  1626.  
  1627. coredump:
  1628. max-dump: unlimited
  1629.  
  1630. napatech:
  1631. # The Host Buffer Allowance for all streams
  1632. # (-1 = OFF, 1 - 100 = percentage of the host buffer that can be held back)
  1633. hba: -1
  1634.  
  1635. # use_all_streams set to "yes" will query the Napatech service for all configured
  1636. # streams and listen on all of them. When set to "no" the streams config array
  1637. # will be used.
  1638. use-all-streams: yes
  1639.  
  1640. # The streams to listen on
  1641. streams: [1, 2, 3]
  1642.  
  1643. # Includes. Files included here will be handled as if they were
  1644. # inlined in this configuration file.
  1645. #include: include1.yaml
  1646. #include: include2.yaml
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!