API tools faq
paste
Guest User

Untitled

a guest
Nov 29th, 2017
181
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 67.97 KB | None | 0 0
raw download clone embed print report
  1. %YAML 1.1
  2. ---
  3.  
  4. # Suricata configuration file. In addition to the comments describing all
  5. # options in this file, full documentation can be found at:
  6. # https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml
  7.  
  8. ##
  9. ## Step 1: inform Suricata about your network
  10. ##
  11.  
  12. vars:
  13. # more specifc is better for alert accuracy and performance
  14. address-groups:
  15. HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
  16. #HOME_NET: "[192.168.0.0/16]"
  17. #HOME_NET: "[10.0.0.0/8]"
  18. #HOME_NET: "[172.16.0.0/12]"
  19. #HOME_NET: "any"
  20.  
  21. EXTERNAL_NET: "!$HOME_NET"
  22. #EXTERNAL_NET: "any"
  23.  
  24. HTTP_SERVERS: "$HOME_NET"
  25. SMTP_SERVERS: "$HOME_NET"
  26. SQL_SERVERS: "$HOME_NET"
  27. DNS_SERVERS: "$HOME_NET"
  28. TELNET_SERVERS: "$HOME_NET"
  29. AIM_SERVERS: "$EXTERNAL_NET"
  30. DNP3_SERVER: "$HOME_NET"
  31. DNP3_CLIENT: "$HOME_NET"
  32. MODBUS_CLIENT: "$HOME_NET"
  33. MODBUS_SERVER: "$HOME_NET"
  34. ENIP_CLIENT: "$HOME_NET"
  35. ENIP_SERVER: "$HOME_NET"
  36.  
  37. port-groups:
  38. HTTP_PORTS: "80"
  39. SHELLCODE_PORTS: "!80"
  40. ORACLE_PORTS: 1521
  41. SSH_PORTS: 22
  42. DNP3_PORTS: 20000
  43. MODBUS_PORTS: 502
  44. FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
  45. FTP_PORTS: 21
  46.  
  47.  
  48. ##
  49. ## Step 2: select the rules to enable or disable
  50. ##
  51.  
  52. default-rule-path: /etc/suricata/rules
  53. rule-files:
  54. - botcc.rules
  55. # - botcc.portgrouped.rules
  56. - ciarmy.rules
  57. - compromised.rules
  58. - drop.rules
  59. - dshield.rules
  60. # - emerging-activex.rules
  61. - emerging-attack_response.rules
  62. - emerging-chat.rules
  63. - emerging-current_events.rules
  64. - emerging-dns.rules
  65. - emerging-dos.rules
  66. - emerging-exploit.rules
  67. - emerging-ftp.rules
  68. # - emerging-games.rules
  69. # - emerging-icmp_info.rules
  70. # - emerging-icmp.rules
  71. - emerging-imap.rules
  72. # - emerging-inappropriate.rules
  73. # - emerging-info.rules
  74. - emerging-malware.rules
  75. - emerging-misc.rules
  76. - emerging-mobile_malware.rules
  77. - emerging-netbios.rules
  78. - emerging-p2p.rules
  79. - emerging-policy.rules
  80. - emerging-pop3.rules
  81. - emerging-rpc.rules
  82. # - emerging-scada.rules
  83. # - emerging-scada_special.rules
  84. - emerging-scan.rules
  85. # - emerging-shellcode.rules
  86. - emerging-smtp.rules
  87. - emerging-snmp.rules
  88. - emerging-sql.rules
  89. - emerging-telnet.rules
  90. - emerging-tftp.rules
  91. - emerging-trojan.rules
  92. - emerging-user_agents.rules
  93. - emerging-voip.rules
  94. - emerging-web_client.rules
  95. - emerging-web_server.rules
  96. # - emerging-web_specific_apps.rules
  97. - emerging-worm.rules
  98. - tor.rules
  99. # - decoder-events.rules # available in suricata sources under rules dir
  100. # - stream-events.rules # available in suricata sources under rules dir
  101. - http-events.rules # available in suricata sources under rules dir
  102. - smtp-events.rules # available in suricata sources under rules dir
  103. - dns-events.rules # available in suricata sources under rules dir
  104. - tls-events.rules # available in suricata sources under rules dir
  105. # - modbus-events.rules # available in suricata sources under rules dir
  106. # - app-layer-events.rules # available in suricata sources under rules dir
  107. # - dnp3-events.rules # available in suricata sources under rules dir
  108. # - ntp-events.rules # available in suricata sources under rules dir
  109.  
  110. classification-file: /etc/suricata/classification.config
  111. reference-config-file: /etc/suricata/reference.config
  112. # threshold-file: /etc/suricata/threshold.config
  113.  
  114.  
  115. ##
  116. ## Step 3: select outputs to enable
  117. ##
  118.  
  119. # The default logging directory. Any log or output file will be
  120. # placed here if its not specified with a full path name. This can be
  121. # overridden with the -l command line parameter.
  122. default-log-dir: /var/log/suricata/
  123.  
  124. # global stats configuration
  125. stats:
  126. enabled: yes
  127. # The interval field (in seconds) controls at what interval
  128. # the loggers are invoked.
  129. interval: 8
  130.  
  131. # Configure the type of alert (and other) logging you would like.
  132. outputs:
  133. # a line based alerts log similar to Snort's fast.log
  134. - fast:
  135. enabled: yes
  136. filename: fast.log
  137. append: yes
  138. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  139.  
  140. # Extensible Event Format (nicknamed EVE) event log in JSON format
  141. - eve-log:
  142. enabled: no
  143. filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
  144. filename: eve.json
  145. #prefix: "@cee: " # prefix to prepend to each log entry
  146. # the following are valid when type: syslog above
  147. #identity: "suricata"
  148. #facility: local5
  149. #level: Info ## possible levels: Emergency, Alert, Critical,
  150. ## Error, Warning, Notice, Info, Debug
  151. #redis:
  152. # server: 127.0.0.1
  153. # port: 6379
  154. # async: true ## if redis replies are read asynchronously
  155. # mode: list ## possible values: list|lpush (default), rpush, channel|publish
  156. # ## lpush and rpush are using a Redis list. "list" is an alias for lpush
  157. # ## publish is using a Redis channel. "channel" is an alias for publish
  158. # key: suricata ## key or channel to use (default to suricata)
  159. # Redis pipelining set up. This will enable to only do a query every
  160. # 'batch-size' events. This should lower the latency induced by network
  161. # connection at the cost of some memory. There is no flushing implemented
  162. # so this setting as to be reserved to high traffic suricata.
  163. # pipelining:
  164. # enabled: yes ## set enable to yes to enable query pipelining
  165. # batch-size: 10 ## number of entry to keep in buffer
  166. types:
  167. - alert:
  168. # payload: yes # enable dumping payload in Base64
  169. # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
  170. # payload-printable: yes # enable dumping payload in printable (lossy) format
  171. # packet: yes # enable dumping of packet (without stream segments)
  172. # http-body: yes # enable dumping of http body in Base64
  173. # http-body-printable: yes # enable dumping of http body in printable format
  174. metadata: yes # add L7/applayer fields, flowbit and other vars to the alert
  175.  
  176. # Enable the logging of tagged packets for rules using the
  177. # "tag" keyword.
  178. tagged-packets: yes
  179.  
  180. # HTTP X-Forwarded-For support by adding an extra field or overwriting
  181. # the source or destination IP address (depending on flow direction)
  182. # with the one reported in the X-Forwarded-For HTTP header. This is
  183. # helpful when reviewing alerts for traffic that is being reverse
  184. # or forward proxied.
  185. xff:
  186. enabled: no
  187. # Two operation modes are available, "extra-data" and "overwrite".
  188. mode: extra-data
  189. # Two proxy deployments are supported, "reverse" and "forward". In
  190. # a "reverse" deployment the IP address used is the last one, in a
  191. # "forward" deployment the first IP address is used.
  192. deployment: reverse
  193. # Header name where the actual IP address will be reported, if more
  194. # than one IP address is present, the last IP address will be the
  195. # one taken into consideration.
  196. header: X-Forwarded-For
  197. - http:
  198. extended: yes # enable this for extended logging information
  199. # custom allows additional http fields to be included in eve-log
  200. # the example below adds three additional fields when uncommented
  201. #custom: [Accept-Encoding, Accept-Language, Authorization]
  202. - dns:
  203. # control logging of queries and answers
  204. # default yes, no to disable
  205. query: yes # enable logging of DNS queries
  206. answer: yes # enable logging of DNS answers
  207. # control which RR types are logged
  208. # all enabled if custom not specified
  209. #custom: [a, aaaa, cname, mx, ns, ptr, txt]
  210. - tls:
  211. extended: yes # enable this for extended logging information
  212. # output TLS transaction where the session is resumed using a
  213. # session id
  214. #session-resumption: no
  215. # custom allows to control which tls fields that are included
  216. # in eve-log
  217. #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain]
  218. - files:
  219. force-magic: no # force logging magic on all logged files
  220. # force logging of checksums, available hash functions are md5,
  221. # sha1 and sha256
  222. #force-hash: [md5]
  223. #- drop:
  224. # alerts: yes # log alerts that caused drops
  225. # flows: all # start or all: 'start' logs only a single drop
  226. # # per flow direction. All logs each dropped pkt.
  227. - smtp:
  228. #extended: yes # enable this for extended logging information
  229. # this includes: bcc, message-id, subject, x_mailer, user-agent
  230. # custom fields logging from the list:
  231. # reply-to, bcc, message-id, subject, x-mailer, user-agent, received,
  232. # x-originating-ip, in-reply-to, references, importance, priority,
  233. # sensitivity, organization, content-md5, date
  234. #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
  235. # output md5 of fields: body, subject
  236. # for the body you need to set app-layer.protocols.smtp.mime.body-md5
  237. # to yes
  238. #md5: [body, subject]
  239.  
  240. #- dnp3
  241. #- nfs
  242. - ssh
  243. - stats:
  244. totals: yes # stats for all threads merged together
  245. threads: no # per thread stats
  246. deltas: no # include delta values
  247. # bi-directional flows
  248. - flow
  249. # uni-directional flows
  250. #- netflow
  251. # Vars log flowbits and other packet and flow vars
  252. #- vars
  253.  
  254. # alert output for use with Barnyard2
  255. - unified2-alert:
  256. enabled: no
  257. filename: unified2.alert
  258.  
  259. # File size limit. Can be specified in kb, mb, gb. Just a number
  260. # is parsed as bytes.
  261. #limit: 32mb
  262.  
  263. # By default unified2 log files have the file creation time (in
  264. # unix epoch format) appended to the filename. Set this to yes to
  265. # disable this behaviour.
  266. #nostamp: no
  267.  
  268. # Sensor ID field of unified2 alerts.
  269. #sensor-id: 0
  270.  
  271. # Include payload of packets related to alerts. Defaults to true, set to
  272. # false if payload is not required.
  273. #payload: yes
  274.  
  275. # HTTP X-Forwarded-For support by adding the unified2 extra header or
  276. # overwriting the source or destination IP address (depending on flow
  277. # direction) with the one reported in the X-Forwarded-For HTTP header.
  278. # This is helpful when reviewing alerts for traffic that is being reverse
  279. # or forward proxied.
  280. xff:
  281. enabled: no
  282. # Two operation modes are available, "extra-data" and "overwrite". Note
  283. # that in the "overwrite" mode, if the reported IP address in the HTTP
  284. # X-Forwarded-For header is of a different version of the packet
  285. # received, it will fall-back to "extra-data" mode.
  286. mode: extra-data
  287. # Two proxy deployments are supported, "reverse" and "forward". In
  288. # a "reverse" deployment the IP address used is the last one, in a
  289. # "forward" deployment the first IP address is used.
  290. deployment: reverse
  291. # Header name where the actual IP address will be reported, if more
  292. # than one IP address is present, the last IP address will be the
  293. # one taken into consideration.
  294. header: X-Forwarded-For
  295.  
  296. # a line based log of HTTP requests (no alerts)
  297. - http-log:
  298. enabled: no
  299. filename: http.log
  300. append: yes
  301. #extended: yes # enable this for extended logging information
  302. #custom: yes # enabled the custom logging format (defined by customformat)
  303. #customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %H %m %h %u %s %B %a:%p -> %A:%P"
  304. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  305.  
  306. # a line based log of TLS handshake parameters (no alerts)
  307. - tls-log:
  308. enabled: no # Log TLS connections.
  309. filename: tls.log # File to store TLS logs.
  310. append: yes
  311. #extended: yes # Log extended information like fingerprint
  312. #custom: yes # enabled the custom logging format (defined by customformat)
  313. #customformat: "%{%D-%H:%M:%S}t.%z %a:%p -> %A:%P %v %n %d %D"
  314. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  315. # output TLS transaction where the session is resumed using a
  316. # session id
  317. #session-resumption: no
  318.  
  319. # output module to store certificates chain to disk
  320. - tls-store:
  321. enabled: no
  322. #certs-log-dir: certs # directory to store the certificates files
  323.  
  324. # a line based log of DNS requests and/or replies (no alerts)
  325. - dns-log:
  326. enabled: no
  327. filename: dns.log
  328. append: yes
  329. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  330.  
  331. # Packet log... log packets in pcap format. 3 modes of operation: "normal"
  332. # "multi" and "sguil".
  333. #
  334. # In normal mode a pcap file "filename" is created in the default-log-dir,
  335. # or are as specified by "dir".
  336. # In multi mode, a file is created per thread. This will perform much
  337. # better, but will create multiple files where 'normal' would create one.
  338. # In multi mode the filename takes a few special variables:
  339. # - %n -- thread number
  340. # - %i -- thread id
  341. # - %t -- timestamp (secs or secs.usecs based on 'ts-format'
  342. # E.g. filename: pcap.%n.%t
  343. #
  344. # Note that it's possible to use directories, but the directories are not
  345. # created by Suricata. E.g. filename: pcaps/%n/log.%s will log into the
  346. # per thread directory.
  347. #
  348. # Also note that the limit and max-files settings are enforced per thread.
  349. # So the size limit when using 8 threads with 1000mb files and 2000 files
  350. # is: 8*1000*2000 ~ 16TiB.
  351. #
  352. # In Sguil mode "dir" indicates the base directory. In this base dir the
  353. # pcaps are created in th directory structure Sguil expects:
  354. #
  355. # $sguil-base-dir/YYYY-MM-DD/$filename.<timestamp>
  356. #
  357. # By default all packets are logged except:
  358. # - TCP streams beyond stream.reassembly.depth
  359. # - encrypted streams after the key exchange
  360. #
  361. - pcap-log:
  362. enabled: no
  363. filename: log.pcap
  364.  
  365. # File size limit. Can be specified in kb, mb, gb. Just a number
  366. # is parsed as bytes.
  367. limit: 1000mb
  368.  
  369. # If set to a value will enable ring buffer mode. Will keep Maximum of "max-files" of size "limit"
  370. max-files: 2000
  371.  
  372. mode: normal # normal, multi or sguil.
  373.  
  374. # Directory to place pcap files. If not provided the default log
  375. # directory will be used. Required for "sguil" mode.
  376. #dir: /nsm_data/
  377.  
  378. #ts-format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec
  379. use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets
  380. honor-pass-rules: no # If set to "yes", flows in which a pass rule matched will stopped being logged.
  381.  
  382. # a full alerts log containing much information for signature writers
  383. # or for investigating suspected false positives.
  384. - alert-debug:
  385. enabled: no
  386. filename: alert-debug.log
  387. append: yes
  388. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  389.  
  390. # alert output to prelude (http://www.prelude-technologies.com/) only
  391. # available if Suricata has been compiled with --enable-prelude
  392. - alert-prelude:
  393. enabled: no
  394. profile: suricata
  395. log-packet-content: no
  396. log-packet-header: yes
  397.  
  398. # Stats.log contains data from various counters of the suricata engine.
  399. - stats:
  400. enabled: yes
  401. filename: stats.log
  402. totals: yes # stats for all threads merged together
  403. threads: no # per thread stats
  404. #null-values: yes # print counters that have value 0
  405.  
  406. # a line based alerts log similar to fast.log into syslog
  407. - syslog:
  408. enabled: no
  409. # reported identity to syslog. If ommited the program name (usually
  410. # suricata) will be used.
  411. #identity: "suricata"
  412. facility: local5
  413. #level: Info ## possible levels: Emergency, Alert, Critical,
  414. ## Error, Warning, Notice, Info, Debug
  415.  
  416. # a line based information for dropped packets in IPS mode
  417. - drop:
  418. enabled: no
  419. filename: drop.log
  420. append: yes
  421. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  422.  
  423. # output module to store extracted files to disk
  424. #
  425. # The files are stored to the log-dir in a format "file.<id>" where <id> is
  426. # an incrementing number starting at 1. For each file "file.<id>" a meta
  427. # file "file.<id>.meta" is created.
  428. #
  429. # File extraction depends on a lot of things to be fully done:
  430. # - file-store stream-depth. For optimal results, set this to 0 (unlimited)
  431. # - http request / response body sizes. Again set to 0 for optimal results.
  432. # - rules that contain the "filestore" keyword.
  433. - file-store:
  434. enabled: no # set to yes to enable
  435. log-dir: files # directory to store the files
  436. force-magic: no # force logging magic on all stored files
  437. # force logging of checksums, available hash functions are md5,
  438. # sha1 and sha256
  439. #force-hash: [md5]
  440. force-filestore: no # force storing of all files
  441. # override global stream-depth for sessions in which we want to
  442. # perform file extraction. Set to 0 for unlimited.
  443. #stream-depth: 0
  444. #waldo: file.waldo # waldo file to store the file_id across runs
  445. # uncomment to disable meta file writing
  446. #write-meta: no
  447. # uncomment the following variable to define how many files can
  448. # remain open for filestore by Suricata. Default value is 0 which
  449. # means files get closed after each write
  450. #max-open-files: 1000
  451.  
  452. # output module to log files tracked in a easily parsable json format
  453. - file-log:
  454. enabled: no
  455. filename: files-json.log
  456. append: yes
  457. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  458.  
  459. force-magic: no # force logging magic on all logged files
  460. # force logging of checksums, available hash functions are md5,
  461. # sha1 and sha256
  462. #force-hash: [md5]
  463.  
  464. # Log TCP data after stream normalization
  465. # 2 types: file or dir. File logs into a single logfile. Dir creates
  466. # 2 files per TCP session and stores the raw TCP data into them.
  467. # Using 'both' will enable both file and dir modes.
  468. #
  469. # Note: limited by stream.depth
  470. - tcp-data:
  471. enabled: no
  472. type: file
  473. filename: tcp-data.log
  474.  
  475. # Log HTTP body data after normalization, dechunking and unzipping.
  476. # 2 types: file or dir. File logs into a single logfile. Dir creates
  477. # 2 files per HTTP session and stores the normalized data into them.
  478. # Using 'both' will enable both file and dir modes.
  479. #
  480. # Note: limited by the body limit settings
  481. - http-body-data:
  482. enabled: no
  483. type: file
  484. filename: http-data.log
  485.  
  486. # Lua Output Support - execute lua script to generate alert and event
  487. # output.
  488. # Documented at:
  489. # https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Lua_Output
  490. - lua:
  491. enabled: no
  492. #scripts-dir: /etc/suricata/lua-output/
  493. scripts:
  494. # - script1.lua
  495.  
  496. # Logging configuration. This is not about logging IDS alerts/events, but
  497. # output about what Suricata is doing, like startup messages, errors, etc.
  498. logging:
  499. # The default log level, can be overridden in an output section.
  500. # Note that debug level logging will only be emitted if Suricata was
  501. # compiled with the --enable-debug configure option.
  502. #
  503. # This value is overriden by the SC_LOG_LEVEL env var.
  504. default-log-level: notice
  505.  
  506. # The default output format. Optional parameter, should default to
  507. # something reasonable if not provided. Can be overriden in an
  508. # output section. You can leave this out to get the default.
  509. #
  510. # This value is overriden by the SC_LOG_FORMAT env var.
  511. #default-log-format: "[%i] %t - (%f:%l) <%d> (%n) -- "
  512.  
  513. # A regex to filter output. Can be overridden in an output section.
  514. # Defaults to empty (no filter).
  515. #
  516. # This value is overriden by the SC_LOG_OP_FILTER env var.
  517. default-output-filter:
  518.  
  519. # Define your logging outputs. If none are defined, or they are all
  520. # disabled you will get the default - console output.
  521. outputs:
  522. - console:
  523. enabled: yes
  524. # type: json
  525. - file:
  526. enabled: yes
  527. level: info
  528. filename: /var/log/suricata/suricata.log
  529. # type: json
  530. - syslog:
  531. enabled: no
  532. facility: local5
  533. format: "[%i] <%d> -- "
  534. # type: json
  535.  
  536.  
  537. ##
  538. ## Step 4: configure common capture settings
  539. ##
  540. ## See "Advanced Capture Options" below for more options, including NETMAP
  541. ## and PF_RING.
  542. ##
  543.  
  544. # Linux high speed capture support
  545. af-packet:
  546. - interface: eth0
  547. # Number of receive threads. "auto" uses the number of cores
  548. #threads: auto
  549. # Default clusterid. AF_PACKET will load balance packets based on flow.
  550. cluster-id: 99
  551. # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
  552. # This is only supported for Linux kernel > 3.1
  553. # possible value are:
  554. # * cluster_round_robin: round robin load balancing
  555. # * cluster_flow: all packets of a given flow are send to the same socket
  556. # * cluster_cpu: all packets treated in kernel by a CPU are send to the same socket
  557. # * cluster_qm: all packets linked by network card to a RSS queue are sent to the same
  558. # socket. Requires at least Linux 3.14.
  559. # * cluster_random: packets are sent randomly to sockets but with an equipartition.
  560. # Requires at least Linux 3.14.
  561. # * cluster_rollover: kernel rotates between sockets filling each socket before moving
  562. # to the next. Requires at least Linux 3.10.
  563. # Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system
  564. # with capture card using RSS (require cpu affinity tuning and system irq tuning)
  565. cluster-type: cluster_flow
  566. # In some fragmentation case, the hash can not be computed. If "defrag" is set
  567. # to yes, the kernel will do the needed defragmentation before sending the packets.
  568. defrag: yes
  569. # After Linux kernel 3.10 it is possible to activate the rollover option: if a socket is
  570. # full then kernel will send the packet on the next socket with room available. This option
  571. # can minimize packet drop and increase the treated bandwidth on single intensive flow.
  572. #rollover: yes
  573. # To use the ring feature of AF_PACKET, set 'use-mmap' to yes
  574. #use-mmap: yes
  575. # Lock memory map to avoid it goes to swap. Be careful that over suscribing could lock
  576. # your system
  577. #mmap-locked: yes
  578. # Use tpacket_v3 capture mode, only active if use-mmap is true
  579. # Don't use it in IPS or TAP mode as it causes severe latency
  580. #tpacket-v3: yes
  581. # Ring size will be computed with respect to max_pending_packets and number
  582. # of threads. You can set manually the ring size in number of packets by setting
  583. # the following value. If you are using flow cluster-type and have really network
  584. # intensive single-flow you could want to set the ring-size independently of the number
  585. # of threads:
  586. #ring-size: 2048
  587. # Block size is used by tpacket_v3 only. It should set to a value high enough to contain
  588. # a decent number of packets. Size is in bytes so please consider your MTU. It should be
  589. # a power of 2 and it must be multiple of page size (usually 4096).
  590. #block-size: 32768
  591. # tpacket_v3 block timeout: an open block is passed to userspace if it is not
  592. # filled after block-timeout milliseconds.
  593. #block-timeout: 10
  594. # On busy system, this could help to set it to yes to recover from a packet drop
  595. # phase. This will result in some packets (at max a ring flush) being non treated.
  596. #use-emergency-flush: yes
  597. # recv buffer size, increase value could improve performance
  598. # buffer-size: 32768
  599. # Set to yes to disable promiscuous mode
  600. # disable-promisc: no
  601. # Choose checksum verification mode for the interface. At the moment
  602. # of the capture, some packets may be with an invalid checksum due to
  603. # offloading to the network card of the checksum computation.
  604. # Possible values are:
  605. # - kernel: use indication sent by kernel for each packet (default)
  606. # - yes: checksum validation is forced
  607. # - no: checksum validation is disabled
  608. # - auto: suricata uses a statistical approach to detect when
  609. # checksum off-loading is used.
  610. # Warning: 'checksum-validation' must be set to yes to have any validation
  611. #checksum-checks: kernel
  612. # BPF filter to apply to this interface. The pcap filter syntax apply here.
  613. #bpf-filter: port 80 or udp
  614. # You can use the following variables to activate AF_PACKET tap or IPS mode.
  615. # If copy-mode is set to ips or tap, the traffic coming to the current
  616. # interface will be copied to the copy-iface interface. If 'tap' is set, the
  617. # copy is complete. If 'ips' is set, the packet matching a 'drop' action
  618. # will not be copied.
  619. #copy-mode: ips
  620. #copy-iface: eth1
  621.  
  622. # Put default values here. These will be used for an interface that is not
  623. # in the list above.
  624. - interface: default
  625. #threads: auto
  626. #use-mmap: no
  627. #rollover: yes
  628. #tpacket-v3: yes
  629.  
  630. # Cross platform libpcap capture support
  631. pcap:
  632. - interface: eth0
  633. # On Linux, pcap will try to use mmaped capture and will use buffer-size
  634. # as total of memory used by the ring. So set this to something bigger
  635. # than 1% of your bandwidth.
  636. #buffer-size: 16777216
  637. #bpf-filter: "tcp and port 25"
  638. # Choose checksum verification mode for the interface. At the moment
  639. # of the capture, some packets may be with an invalid checksum due to
  640. # offloading to the network card of the checksum computation.
  641. # Possible values are:
  642. # - yes: checksum validation is forced
  643. # - no: checksum validation is disabled
  644. # - auto: suricata uses a statistical approach to detect when
  645. # checksum off-loading is used. (default)
  646. # Warning: 'checksum-validation' must be set to yes to have any validation
  647. #checksum-checks: auto
  648. # With some accelerator cards using a modified libpcap (like myricom), you
  649. # may want to have the same number of capture threads as the number of capture
  650. # rings. In this case, set up the threads variable to N to start N threads
  651. # listening on the same interface.
  652. #threads: 16
  653. # set to no to disable promiscuous mode:
  654. #promisc: no
  655. # set snaplen, if not set it defaults to MTU if MTU can be known
  656. # via ioctl call and to full capture if not.
  657. #snaplen: 1518
  658. # Put default values here
  659. - interface: default
  660. #checksum-checks: auto
  661.  
  662. # Settings for reading pcap files
  663. pcap-file:
  664. # Possible values are:
  665. # - yes: checksum validation is forced
  666. # - no: checksum validation is disabled
  667. # - auto: suricata uses a statistical approach to detect when
  668. # checksum off-loading is used. (default)
  669. # Warning: 'checksum-validation' must be set to yes to have checksum tested
  670. checksum-checks: auto
  671.  
  672. # See "Advanced Capture Options" below for more options, including NETMAP
  673. # and PF_RING.
  674.  
  675.  
  676. ##
  677. ## Step 5: App Layer Protocol Configuration
  678. ##
  679.  
  680. # Configure the app-layer parsers. The protocols section details each
  681. # protocol.
  682. #
  683. # The option "enabled" takes 3 values - "yes", "no", "detection-only".
  684. # "yes" enables both detection and the parser, "no" disables both, and
  685. # "detection-only" enables protocol detection only (parser disabled).
  686. app-layer:
  687. protocols:
  688. tls:
  689. enabled: yes
  690. detection-ports:
  691. dp: 443
  692.  
  693. # Completely stop processing TLS/SSL session after the handshake
  694. # completed. If bypass is enabled this will also trigger flow
  695. # bypass. If disabled (the default), TLS/SSL session is still
  696. # tracked for Heartbleed and other anomalies.
  697. #no-reassemble: yes
  698. dcerpc:
  699. enabled: yes
  700. ftp:
  701. enabled: yes
  702. ssh:
  703. enabled: yes
  704. smtp:
  705. enabled: yes
  706. # Configure SMTP-MIME Decoder
  707. mime:
  708. # Decode MIME messages from SMTP transactions
  709. # (may be resource intensive)
  710. # This field supercedes all others because it turns the entire
  711. # process on or off
  712. decode-mime: yes
  713.  
  714. # Decode MIME entity bodies (ie. base64, quoted-printable, etc.)
  715. decode-base64: yes
  716. decode-quoted-printable: yes
  717.  
  718. # Maximum bytes per header data value stored in the data structure
  719. # (default is 2000)
  720. header-value-depth: 2000
  721.  
  722. # Extract URLs and save in state data structure
  723. extract-urls: yes
  724. # Set to yes to compute the md5 of the mail body. You will then
  725. # be able to journalize it.
  726. body-md5: no
  727. # Configure inspected-tracker for file_data keyword
  728. inspected-tracker:
  729. content-limit: 100000
  730. content-inspect-min-size: 32768
  731. content-inspect-window: 4096
  732. imap:
  733. enabled: detection-only
  734. msn:
  735. enabled: detection-only
  736. smb:
  737. enabled: yes
  738. detection-ports:
  739. dp: 139, 445
  740. # smb2 detection is disabled internally inside the engine.
  741. #smb2:
  742. # enabled: yes
  743. # Note: NFS parser depends on Rust support: pass --enable-rust
  744. # to configure.
  745. nfs:
  746. enabled: no
  747. dns:
  748. # memcaps. Globally and per flow/state.
  749. #global-memcap: 16mb
  750. #state-memcap: 512kb
  751.  
  752. # How many unreplied DNS requests are considered a flood.
  753. # If the limit is reached, app-layer-event:dns.flooded; will match.
  754. #request-flood: 500
  755.  
  756. tcp:
  757. enabled: yes
  758. detection-ports:
  759. dp: 53
  760. udp:
  761. enabled: yes
  762. detection-ports:
  763. dp: 53
  764. http:
  765. enabled: yes
  766. # memcap: 64mb
  767.  
  768. # default-config: Used when no server-config matches
  769. # personality: List of personalities used by default
  770. # request-body-limit: Limit reassembly of request body for inspection
  771. # by http_client_body & pcre /P option.
  772. # response-body-limit: Limit reassembly of response body for inspection
  773. # by file_data, http_server_body & pcre /Q option.
  774. # double-decode-path: Double decode path section of the URI
  775. # double-decode-query: Double decode query section of the URI
  776. # response-body-decompress-layer-limit:
  777. # Limit to how many layers of compression will be
  778. # decompressed. Defaults to 2.
  779. #
  780. # server-config: List of server configurations to use if address matches
  781. # address: List of ip addresses or networks for this block
  782. # personalitiy: List of personalities used by this block
  783. # request-body-limit: Limit reassembly of request body for inspection
  784. # by http_client_body & pcre /P option.
  785. # response-body-limit: Limit reassembly of response body for inspection
  786. # by file_data, http_server_body & pcre /Q option.
  787. # double-decode-path: Double decode path section of the URI
  788. # double-decode-query: Double decode query section of the URI
  789. #
  790. # uri-include-all: Include all parts of the URI. By default the
  791. # 'scheme', username/password, hostname and port
  792. # are excluded. Setting this option to true adds
  793. # all of them to the normalized uri as inspected
  794. # by http_uri, urilen, pcre with /U and the other
  795. # keywords that inspect the normalized uri.
  796. # Note that this does not affect http_raw_uri.
  797. # Also, note that including all was the default in
  798. # 1.4 and 2.0beta1.
  799. #
  800. # meta-field-limit: Hard size limit for request and response size
  801. # limits. Applies to request line and headers,
  802. # response line and headers. Does not apply to
  803. # request or response bodies. Default is 18k.
  804. # If this limit is reached an event is raised.
  805. #
  806. # Currently Available Personalities:
  807. # Minimal, Generic, IDS (default), IIS_4_0, IIS_5_0, IIS_5_1, IIS_6_0,
  808. # IIS_7_0, IIS_7_5, Apache_2
  809. libhtp:
  810. default-config:
  811. personality: IDS
  812.  
  813. # Can be specified in kb, mb, gb. Just a number indicates
  814. # it's in bytes.
  815. request-body-limit: 100kb
  816. response-body-limit: 100kb
  817.  
  818. # inspection limits
  819. request-body-minimal-inspect-size: 32kb
  820. request-body-inspect-window: 4kb
  821. response-body-minimal-inspect-size: 40kb
  822. response-body-inspect-window: 16kb
  823.  
  824. # response body decompression (0 disables)
  825. response-body-decompress-layer-limit: 2
  826.  
  827. # auto will use http-body-inline mode in IPS mode, yes or no set it statically
  828. http-body-inline: auto
  829.  
  830. # Take a random value for inspection sizes around the specified value.
  831. # This lower the risk of some evasion technics but could lead
  832. # detection change between runs. It is set to 'yes' by default.
  833. #randomize-inspection-sizes: yes
  834. # If randomize-inspection-sizes is active, the value of various
  835. # inspection size will be choosen in the [1 - range%, 1 + range%]
  836. # range
  837. # Default value of randomize-inspection-range is 10.
  838. #randomize-inspection-range: 10
  839.  
  840. # decoding
  841. double-decode-path: no
  842. double-decode-query: no
  843.  
  844. server-config:
  845.  
  846. #- apache:
  847. # address: [192.168.1.0/24, 127.0.0.0/8, "::1"]
  848. # personality: Apache_2
  849. # # Can be specified in kb, mb, gb. Just a number indicates
  850. # # it's in bytes.
  851. # request-body-limit: 4096
  852. # response-body-limit: 4096
  853. # double-decode-path: no
  854. # double-decode-query: no
  855.  
  856. #- iis7:
  857. # address:
  858. # - 192.168.0.0/24
  859. # - 192.168.10.0/24
  860. # personality: IIS_7_0
  861. # # Can be specified in kb, mb, gb. Just a number indicates
  862. # # it's in bytes.
  863. # request-body-limit: 4096
  864. # response-body-limit: 4096
  865. # double-decode-path: no
  866. # double-decode-query: no
  867.  
  868. # Note: Modbus probe parser is minimalist due to the poor significant field
  869. # Only Modbus message length (greater than Modbus header length)
  870. # And Protocol ID (equal to 0) are checked in probing parser
  871. # It is important to enable detection port and define Modbus port
  872. # to avoid false positive
  873. modbus:
  874. # How many unreplied Modbus requests are considered a flood.
  875. # If the limit is reached, app-layer-event:modbus.flooded; will match.
  876. #request-flood: 500
  877.  
  878. enabled: no
  879. detection-ports:
  880. dp: 502
  881. # According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it
  882. # is recommended to keep the TCP connection opened with a remote device
  883. # and not to open and close it for each MODBUS/TCP transaction. In that
  884. # case, it is important to set the depth of the stream reassembling as
  885. # unlimited (stream.reassembly.depth: 0)
  886.  
  887. # Stream reassembly size for modbus. By default track it completely.
  888. stream-depth: 0
  889.  
  890. # DNP3
  891. dnp3:
  892. enabled: no
  893. detection-ports:
  894. dp: 20000
  895.  
  896. # SCADA EtherNet/IP and CIP protocol support
  897. enip:
  898. enabled: no
  899. detection-ports:
  900. dp: 44818
  901. sp: 44818
  902.  
  903. # Note: parser depends on experimental Rust support
  904. # with --enable-rust-experimental passed to configure
  905. ntp:
  906. enabled: no
  907.  
  908. # Limit for the maximum number of asn1 frames to decode (default 256)
  909. asn1-max-frames: 256
  910.  
  911.  
  912. ##############################################################################
  913. ##
  914. ## Advanced settings below
  915. ##
  916. ##############################################################################
  917.  
  918. ##
  919. ## Run Options
  920. ##
  921.  
  922. # Run suricata as user and group.
  923. #run-as:
  924. # user: suri
  925. # group: suri
  926.  
  927. # Some logging module will use that name in event as identifier. The default
  928. # value is the hostname
  929. #sensor-name: suricata
  930.  
  931. # Default location of the pid file. The pid file is only used in
  932. # daemon mode (start Suricata with -D). If not running in daemon mode
  933. # the --pidfile command line option must be used to create a pid file.
  934. #pid-file: /var/run/suricata.pid
  935.  
  936. # Daemon working directory
  937. # Suricata will change directory to this one if provided
  938. # Default: "/"
  939. #daemon-directory: "/"
  940.  
  941. # Suricata core dump configuration. Limits the size of the core dump file to
  942. # approximately max-dump. The actual core dump size will be a multiple of the
  943. # page size. Core dumps that would be larger than max-dump are truncated. On
  944. # Linux, the actual core dump size may be a few pages larger than max-dump.
  945. # Setting max-dump to 0 disables core dumping.
  946. # Setting max-dump to 'unlimited' will give the full core dump file.
  947. # On 32-bit Linux, a max-dump value >= ULONG_MAX may cause the core dump size
  948. # to be 'unlimited'.
  949.  
  950. coredump:
  951. max-dump: unlimited
  952.  
  953. # If suricata box is a router for the sniffed networks, set it to 'router'. If
  954. # it is a pure sniffing setup, set it to 'sniffer-only'.
  955. # If set to auto, the variable is internally switch to 'router' in IPS mode
  956. # and 'sniffer-only' in IDS mode.
  957. # This feature is currently only used by the reject* keywords.
  958. host-mode: auto
  959.  
  960. # Number of packets preallocated per thread. The default is 1024. A higher number
  961. # will make sure each CPU will be more easily kept busy, but may negatively
  962. # impact caching.
  963. #
  964. # If you are using the CUDA pattern matcher (mpm-algo: ac-cuda), different rules
  965. # apply. In that case try something like 60000 or more. This is because the CUDA
  966. # pattern matcher buffers and scans as many packets as possible in parallel.
  967. #max-pending-packets: 1024
  968.  
  969. # Runmode the engine should use. Please check --list-runmodes to get the available
  970. # runmodes for each packet acquisition method. Defaults to "autofp" (auto flow pinned
  971. # load balancing).
  972. #runmode: autofp
  973.  
  974. # Specifies the kind of flow load balancer used by the flow pinned autofp mode.
  975. #
  976. # Supported schedulers are:
  977. #
  978. # round-robin - Flows assigned to threads in a round robin fashion.
  979. # active-packets - Flows assigned to threads that have the lowest number of
  980. # unprocessed packets (default).
  981. # hash - Flow alloted usihng the address hash. More of a random
  982. # technique. Was the default in Suricata 1.2.1 and older.
  983. #
  984. #autofp-scheduler: active-packets
  985.  
  986. # Preallocated size for packet. Default is 1514 which is the classical
  987. # size for pcap on ethernet. You should adjust this value to the highest
  988. # packet size (MTU + hardware header) on your system.
  989. #default-packet-size: 1514
  990.  
  991. # Unix command socket can be used to pass commands to suricata.
  992. # An external tool can then connect to get information from suricata
  993. # or trigger some modifications of the engine. Set enabled to yes
  994. # to activate the feature. In auto mode, the feature will only be
  995. # activated in live capture mode. You can use the filename variable to set
  996. # the file name of the socket.
  997. unix-command:
  998. enabled: auto
  999. #filename: custom.socket
  1000.  
  1001. # Magic file. The extension .mgc is added to the value here.
  1002. #magic-file: /usr/share/file/magic
  1003. #magic-file:
  1004.  
  1005. legacy:
  1006. uricontent: enabled
  1007.  
  1008. ##
  1009. ## Detection settings
  1010. ##
  1011.  
  1012. # Set the order of alerts bassed on actions
  1013. # The default order is pass, drop, reject, alert
  1014. # action-order:
  1015. # - pass
  1016. # - drop
  1017. # - reject
  1018. # - alert
  1019.  
  1020. # IP Reputation
  1021. #reputation-categories-file: /etc/suricata/iprep/categories.txt
  1022. #default-reputation-path: /etc/suricata/iprep
  1023. #reputation-files:
  1024. # - reputation.list
  1025.  
  1026. # When run with the option --engine-analysis, the engine will read each of
  1027. # the parameters below, and print reports for each of the enabled sections
  1028. # and exit. The reports are printed to a file in the default log dir
  1029. # given by the parameter "default-log-dir", with engine reporting
  1030. # subsection below printing reports in its own report file.
  1031. engine-analysis:
  1032. # enables printing reports for fast-pattern for every rule.
  1033. rules-fast-pattern: yes
  1034. # enables printing reports for each rule
  1035. rules: yes
  1036.  
  1037. #recursion and match limits for PCRE where supported
  1038. pcre:
  1039. match-limit: 3500
  1040. match-limit-recursion: 1500
  1041.  
  1042. ##
  1043. ## Advanced Traffic Tracking and Reconstruction Settings
  1044. ##
  1045.  
  1046. # Host specific policies for defragmentation and TCP stream
  1047. # reassembly. The host OS lookup is done using a radix tree, just
  1048. # like a routing table so the most specific entry matches.
  1049. host-os-policy:
  1050. # Make the default policy windows.
  1051. windows: [0.0.0.0/0]
  1052. bsd: []
  1053. bsd-right: []
  1054. old-linux: []
  1055. linux: []
  1056. old-solaris: []
  1057. solaris: []
  1058. hpux10: []
  1059. hpux11: []
  1060. irix: []
  1061. macos: []
  1062. vista: []
  1063. windows2k3: []
  1064.  
  1065. # Defrag settings:
  1066.  
  1067. defrag:
  1068. memcap: 32mb
  1069. hash-size: 65536
  1070. trackers: 65535 # number of defragmented flows to follow
  1071. max-frags: 65535 # number of fragments to keep (higher than trackers)
  1072. prealloc: yes
  1073. timeout: 60
  1074.  
  1075. # Enable defrag per host settings
  1076. # host-config:
  1077. #
  1078. # - dmz:
  1079. # timeout: 30
  1080. # address: [192.168.1.0/24, 127.0.0.0/8, 1.1.1.0/24, 2.2.2.0/24, "1.1.1.1", "2.2.2.2", "::1"]
  1081. #
  1082. # - lan:
  1083. # timeout: 45
  1084. # address:
  1085. # - 192.168.0.0/24
  1086. # - 192.168.10.0/24
  1087. # - 172.16.14.0/24
  1088.  
  1089. # Flow settings:
  1090. # By default, the reserved memory (memcap) for flows is 32MB. This is the limit
  1091. # for flow allocation inside the engine. You can change this value to allow
  1092. # more memory usage for flows.
  1093. # The hash-size determine the size of the hash used to identify flows inside
  1094. # the engine, and by default the value is 65536.
  1095. # At the startup, the engine can preallocate a number of flows, to get a better
  1096. # performance. The number of flows preallocated is 10000 by default.
  1097. # emergency-recovery is the percentage of flows that the engine need to
  1098. # prune before unsetting the emergency state. The emergency state is activated
  1099. # when the memcap limit is reached, allowing to create new flows, but
  1100. # prunning them with the emergency timeouts (they are defined below).
  1101. # If the memcap is reached, the engine will try to prune flows
  1102. # with the default timeouts. If it doens't find a flow to prune, it will set
  1103. # the emergency bit and it will try again with more agressive timeouts.
  1104. # If that doesn't work, then it will try to kill the last time seen flows
  1105. # not in use.
  1106. # The memcap can be specified in kb, mb, gb. Just a number indicates it's
  1107. # in bytes.
  1108.  
  1109. flow:
  1110. memcap: 128mb
  1111. hash-size: 65536
  1112. prealloc: 10000
  1113. emergency-recovery: 30
  1114. #managers: 1 # default to one flow manager
  1115. #recyclers: 1 # default to one flow recycler thread
  1116.  
  1117. # This option controls the use of vlan ids in the flow (and defrag)
  1118. # hashing. Normally this should be enabled, but in some (broken)
  1119. # setups where both sides of a flow are not tagged with the same vlan
  1120. # tag, we can ignore the vlan id's in the flow hashing.
  1121. vlan:
  1122. use-for-tracking: true
  1123.  
  1124. # Specific timeouts for flows. Here you can specify the timeouts that the
  1125. # active flows will wait to transit from the current state to another, on each
  1126. # protocol. The value of "new" determine the seconds to wait after a hanshake or
  1127. # stream startup before the engine free the data of that flow it doesn't
  1128. # change the state to established (usually if we don't receive more packets
  1129. # of that flow). The value of "established" is the amount of
  1130. # seconds that the engine will wait to free the flow if it spend that amount
  1131. # without receiving new packets or closing the connection. "closed" is the
  1132. # amount of time to wait after a flow is closed (usually zero). "bypassed"
  1133. # timeout controls locally bypassed flows. For these flows we don't do any other
  1134. # tracking. If no packets have been seen after this timeout, the flow is discarded.
  1135. #
  1136. # There's an emergency mode that will become active under attack circumstances,
  1137. # making the engine to check flow status faster. This configuration variables
  1138. # use the prefix "emergency-" and work similar as the normal ones.
  1139. # Some timeouts doesn't apply to all the protocols, like "closed", for udp and
  1140. # icmp.
  1141.  
  1142. flow-timeouts:
  1143.  
  1144. default:
  1145. new: 30
  1146. established: 300
  1147. closed: 0
  1148. bypassed: 100
  1149. emergency-new: 10
  1150. emergency-established: 100
  1151. emergency-closed: 0
  1152. emergency-bypassed: 50
  1153. tcp:
  1154. new: 60
  1155. established: 600
  1156. closed: 60
  1157. bypassed: 100
  1158. emergency-new: 5
  1159. emergency-established: 100
  1160. emergency-closed: 10
  1161. emergency-bypassed: 50
  1162. udp:
  1163. new: 30
  1164. established: 300
  1165. bypassed: 100
  1166. emergency-new: 10
  1167. emergency-established: 100
  1168. emergency-bypassed: 50
  1169. icmp:
  1170. new: 30
  1171. established: 300
  1172. bypassed: 100
  1173. emergency-new: 10
  1174. emergency-established: 100
  1175. emergency-bypassed: 50
  1176.  
  1177. # Stream engine settings. Here the TCP stream tracking and reassembly
  1178. # engine is configured.
  1179. #
  1180. # stream:
  1181. # memcap: 32mb # Can be specified in kb, mb, gb. Just a
  1182. # # number indicates it's in bytes.
  1183. # checksum-validation: yes # To validate the checksum of received
  1184. # # packet. If csum validation is specified as
  1185. # # "yes", then packet with invalid csum will not
  1186. # # be processed by the engine stream/app layer.
  1187. # # Warning: locally generated trafic can be
  1188. # # generated without checksum due to hardware offload
  1189. # # of checksum. You can control the handling of checksum
  1190. # # on a per-interface basis via the 'checksum-checks'
  1191. # # option
  1192. # prealloc-sessions: 2k # 2k sessions prealloc'd per stream thread
  1193. # midstream: false # don't allow midstream session pickups
  1194. # async-oneside: false # don't enable async stream handling
  1195. # inline: no # stream inline mode
  1196. # drop-invalid: yes # in inline mode, drop packets that are invalid with regards to streaming engine
  1197. # max-synack-queued: 5 # Max different SYN/ACKs to queue
  1198. # bypass: no # Bypass packets when stream.depth is reached
  1199. #
  1200. # reassembly:
  1201. # memcap: 64mb # Can be specified in kb, mb, gb. Just a number
  1202. # # indicates it's in bytes.
  1203. # depth: 1mb # Can be specified in kb, mb, gb. Just a number
  1204. # # indicates it's in bytes.
  1205. # toserver-chunk-size: 2560 # inspect raw stream in chunks of at least
  1206. # # this size. Can be specified in kb, mb,
  1207. # # gb. Just a number indicates it's in bytes.
  1208. # toclient-chunk-size: 2560 # inspect raw stream in chunks of at least
  1209. # # this size. Can be specified in kb, mb,
  1210. # # gb. Just a number indicates it's in bytes.
  1211. # randomize-chunk-size: yes # Take a random value for chunk size around the specified value.
  1212. # # This lower the risk of some evasion technics but could lead
  1213. # # detection change between runs. It is set to 'yes' by default.
  1214. # randomize-chunk-range: 10 # If randomize-chunk-size is active, the value of chunk-size is
  1215. # # a random value between (1 - randomize-chunk-range/100)*toserver-chunk-size
  1216. # # and (1 + randomize-chunk-range/100)*toserver-chunk-size and the same
  1217. # # calculation for toclient-chunk-size.
  1218. # # Default value of randomize-chunk-range is 10.
  1219. #
  1220. # raw: yes # 'Raw' reassembly enabled or disabled.
  1221. # # raw is for content inspection by detection
  1222. # # engine.
  1223. #
  1224. # segment-prealloc: 2048 # number of segments preallocated per thread
  1225. #
  1226. # check-overlap-different-data: true|false
  1227. # # check if a segment contains different data
  1228. # # than what we've already seen for that
  1229. # # position in the stream.
  1230. # # This is enabled automatically if inline mode
  1231. # # is used or when stream-event:reassembly_overlap_different_data;
  1232. # # is used in a rule.
  1233. #
  1234. stream:
  1235. memcap: 64mb
  1236. checksum-validation: yes # reject wrong csums
  1237. inline: auto # auto will use inline mode in IPS mode, yes or no set it statically
  1238. reassembly:
  1239. memcap: 256mb
  1240. depth: 1mb # reassemble 1mb into a stream
  1241. toserver-chunk-size: 2560
  1242. toclient-chunk-size: 2560
  1243. randomize-chunk-size: yes
  1244. #randomize-chunk-range: 10
  1245. #raw: yes
  1246. #segment-prealloc: 2048
  1247. #check-overlap-different-data: true
  1248.  
  1249. # Host table:
  1250. #
  1251. # Host table is used by tagging and per host thresholding subsystems.
  1252. #
  1253. host:
  1254. hash-size: 4096
  1255. prealloc: 1000
  1256. memcap: 32mb
  1257.  
  1258. # IP Pair table:
  1259. #
  1260. # Used by xbits 'ippair' tracking.
  1261. #
  1262. #ippair:
  1263. # hash-size: 4096
  1264. # prealloc: 1000
  1265. # memcap: 32mb
  1266.  
  1267. # Decoder settings
  1268.  
  1269. decoder:
  1270. # Teredo decoder is known to not be completely accurate
  1271. # it will sometimes detect non-teredo as teredo.
  1272. teredo:
  1273. enabled: true
  1274.  
  1275.  
  1276. ##
  1277. ## Performance tuning and profiling
  1278. ##
  1279.  
  1280. # The detection engine builds internal groups of signatures. The engine
  1281. # allow us to specify the profile to use for them, to manage memory on an
  1282. # efficient way keeping a good performance. For the profile keyword you
  1283. # can use the words "low", "medium", "high" or "custom". If you use custom
  1284. # make sure to define the values at "- custom-values" as your convenience.
  1285. # Usually you would prefer medium/high/low.
  1286. #
  1287. # "sgh mpm-context", indicates how the staging should allot mpm contexts for
  1288. # the signature groups. "single" indicates the use of a single context for
  1289. # all the signature group heads. "full" indicates a mpm-context for each
  1290. # group head. "auto" lets the engine decide the distribution of contexts
  1291. # based on the information the engine gathers on the patterns from each
  1292. # group head.
  1293. #
  1294. # The option inspection-recursion-limit is used to limit the recursive calls
  1295. # in the content inspection code. For certain payload-sig combinations, we
  1296. # might end up taking too much time in the content inspection code.
  1297. # If the argument specified is 0, the engine uses an internally defined
  1298. # default limit. On not specifying a value, we use no limits on the recursion.
  1299. detect:
  1300. profile: medium
  1301. custom-values:
  1302. toclient-groups: 3
  1303. toserver-groups: 25
  1304. sgh-mpm-context: auto
  1305. inspection-recursion-limit: 3000
  1306. # If set to yes, the loading of signatures will be made after the capture
  1307. # is started. This will limit the downtime in IPS mode.
  1308. #delayed-detect: yes
  1309.  
  1310. prefilter:
  1311. # default prefiltering setting. "mpm" only creates MPM/fast_pattern
  1312. # engines. "auto" also sets up prefilter engines for other keywords.
  1313. # Use --list-keywords=all to see which keywords support prefiltering.
  1314. default: mpm
  1315.  
  1316. # the grouping values above control how many groups are created per
  1317. # direction. Port whitelisting forces that port to get it's own group.
  1318. # Very common ports will benefit, as well as ports with many expensive
  1319. # rules.
  1320. grouping:
  1321. #tcp-whitelist: 53, 80, 139, 443, 445, 1433, 3306, 3389, 6666, 6667, 8080
  1322. #udp-whitelist: 53, 135, 5060
  1323.  
  1324. profiling:
  1325. # Log the rules that made it past the prefilter stage, per packet
  1326. # default is off. The threshold setting determines how many rules
  1327. # must have made it past pre-filter for that rule to trigger the
  1328. # logging.
  1329. #inspect-logging-threshold: 200
  1330. grouping:
  1331. dump-to-disk: false
  1332. include-rules: false # very verbose
  1333. include-mpm-stats: false
  1334.  
  1335. # Select the multi pattern algorithm you want to run for scan/search the
  1336. # in the engine.
  1337. #
  1338. # The supported algorithms are:
  1339. # "ac" - Aho-Corasick, default implementation
  1340. # "ac-bs" - Aho-Corasick, reduced memory implementation
  1341. # "ac-cuda" - Aho-Corasick, CUDA implementation
  1342. # "ac-ks" - Aho-Corasick, "Ken Steele" variant
  1343. # "hs" - Hyperscan, available when built with Hyperscan support
  1344. #
  1345. # The default mpm-algo value of "auto" will use "hs" if Hyperscan is
  1346. # available, "ac" otherwise.
  1347. #
  1348. # The mpm you choose also decides the distribution of mpm contexts for
  1349. # signature groups, specified by the conf - "detect.sgh-mpm-context".
  1350. # Selecting "ac" as the mpm would require "detect.sgh-mpm-context"
  1351. # to be set to "single", because of ac's memory requirements, unless the
  1352. # ruleset is small enough to fit in one's memory, in which case one can
  1353. # use "full" with "ac". Rest of the mpms can be run in "full" mode.
  1354. #
  1355. # There is also a CUDA pattern matcher (only available if Suricata was
  1356. # compiled with --enable-cuda: b2g_cuda. Make sure to update your
  1357. # max-pending-packets setting above as well if you use b2g_cuda.
  1358.  
  1359. mpm-algo: auto
  1360.  
  1361. # Select the matching algorithm you want to use for single-pattern searches.
  1362. #
  1363. # Supported algorithms are "bm" (Boyer-Moore) and "hs" (Hyperscan, only
  1364. # available if Suricata has been built with Hyperscan support).
  1365. #
  1366. # The default of "auto" will use "hs" if available, otherwise "bm".
  1367.  
  1368. spm-algo: auto
  1369.  
  1370. # Suricata is multi-threaded. Here the threading can be influenced.
  1371. threading:
  1372. set-cpu-affinity: no
  1373. # Tune cpu affinity of threads. Each family of threads can be bound
  1374. # on specific CPUs.
  1375. #
  1376. # These 2 apply to the all runmodes:
  1377. # management-cpu-set is used for flow timeout handling, counters
  1378. # worker-cpu-set is used for 'worker' threads
  1379. #
  1380. # Additionally, for autofp these apply:
  1381. # receive-cpu-set is used for capture threads
  1382. # verdict-cpu-set is used for IPS verdict threads
  1383. #
  1384. cpu-affinity:
  1385. - management-cpu-set:
  1386. cpu: [ 0 ] # include only these cpus in affinity settings
  1387. - receive-cpu-set:
  1388. cpu: [ 0 ] # include only these cpus in affinity settings
  1389. - worker-cpu-set:
  1390. cpu: [ "all" ]
  1391. mode: "exclusive"
  1392. # Use explicitely 3 threads and don't compute number by using
  1393. # detect-thread-ratio variable:
  1394. # threads: 3
  1395. prio:
  1396. low: [ 0 ]
  1397. medium: [ "1-2" ]
  1398. high: [ 3 ]
  1399. default: "medium"
  1400. #- verdict-cpu-set:
  1401. # cpu: [ 0 ]
  1402. # prio:
  1403. # default: "high"
  1404. #
  1405. # By default Suricata creates one "detect" thread per available CPU/CPU core.
  1406. # This setting allows controlling this behaviour. A ratio setting of 2 will
  1407. # create 2 detect threads for each CPU/CPU core. So for a dual core CPU this
  1408. # will result in 4 detect threads. If values below 1 are used, less threads
  1409. # are created. So on a dual core CPU a setting of 0.5 results in 1 detect
  1410. # thread being created. Regardless of the setting at a minimum 1 detect
  1411. # thread will always be created.
  1412. #
  1413. detect-thread-ratio: 1.0
  1414.  
  1415. # Luajit has a strange memory requirement, it's 'states' need to be in the
  1416. # first 2G of the process' memory.
  1417. #
  1418. # 'luajit.states' is used to control how many states are preallocated.
  1419. # State use: per detect script: 1 per detect thread. Per output script: 1 per
  1420. # script.
  1421. luajit:
  1422. states: 128
  1423.  
  1424. # Profiling settings. Only effective if Suricata has been built with the
  1425. # the --enable-profiling configure flag.
  1426. #
  1427. profiling:
  1428. # Run profiling for every xth packet. The default is 1, which means we
  1429. # profile every packet. If set to 1000, one packet is profiled for every
  1430. # 1000 received.
  1431. #sample-rate: 1000
  1432.  
  1433. # rule profiling
  1434. rules:
  1435.  
  1436. # Profiling can be disabled here, but it will still have a
  1437. # performance impact if compiled in.
  1438. enabled: yes
  1439. filename: rule_perf.log
  1440. append: yes
  1441.  
  1442. # Sort options: ticks, avgticks, checks, matches, maxticks
  1443. # If commented out all the sort options will be used.
  1444. #sort: avgticks
  1445.  
  1446. # Limit the number of sids for which stats are shown at exit (per sort).
  1447. limit: 10
  1448.  
  1449. # output to json
  1450. json: no
  1451.  
  1452. # per keyword profiling
  1453. keywords:
  1454. enabled: yes
  1455. filename: keyword_perf.log
  1456. append: yes
  1457.  
  1458. # per rulegroup profiling
  1459. rulegroups:
  1460. enabled: yes
  1461. filename: rule_group_perf.log
  1462. append: yes
  1463.  
  1464. # packet profiling
  1465. packets:
  1466.  
  1467. # Profiling can be disabled here, but it will still have a
  1468. # performance impact if compiled in.
  1469. enabled: yes
  1470. filename: packet_stats.log
  1471. append: yes
  1472.  
  1473. # per packet csv output
  1474. csv:
  1475.  
  1476. # Output can be disabled here, but it will still have a
  1477. # performance impact if compiled in.
  1478. enabled: no
  1479. filename: packet_stats.csv
  1480.  
  1481. # profiling of locking. Only available when Suricata was built with
  1482. # --enable-profiling-locks.
  1483. locks:
  1484. enabled: no
  1485. filename: lock_stats.log
  1486. append: yes
  1487.  
  1488. pcap-log:
  1489. enabled: no
  1490. filename: pcaplog_stats.log
  1491. append: yes
  1492.  
  1493. ##
  1494. ## Netfilter integration
  1495. ##
  1496.  
  1497. # When running in NFQ inline mode, it is possible to use a simulated
  1498. # non-terminal NFQUEUE verdict.
  1499. # This permit to do send all needed packet to suricata via this a rule:
  1500. # iptables -I FORWARD -m mark ! --mark $MARK/$MASK -j NFQUEUE
  1501. # And below, you can have your standard filtering ruleset. To activate
  1502. # this mode, you need to set mode to 'repeat'
  1503. # If you want packet to be sent to another queue after an ACCEPT decision
  1504. # set mode to 'route' and set next-queue value.
  1505. # On linux >= 3.1, you can set batchcount to a value > 1 to improve performance
  1506. # by processing several packets before sending a verdict (worker runmode only).
  1507. # On linux >= 3.6, you can set the fail-open option to yes to have the kernel
  1508. # accept the packet if suricata is not able to keep pace.
  1509. # bypass mark and mask can be used to implement NFQ bypass. If bypass mark is
  1510. # set then the NFQ bypass is activated. Suricata will set the bypass mark/mask
  1511. # on packet of a flow that need to be bypassed. The Nefilter ruleset has to
  1512. # directly accept all packets of a flow once a packet has been marked.
  1513. nfq:
  1514. # mode: accept
  1515. # repeat-mark: 1
  1516. # repeat-mask: 1
  1517. # bypass-mark: 1
  1518. # bypass-mask: 1
  1519. # route-queue: 2
  1520. # batchcount: 20
  1521. # fail-open: yes
  1522.  
  1523. #nflog support
  1524. nflog:
  1525. # netlink multicast group
  1526. # (the same as the iptables --nflog-group param)
  1527. # Group 0 is used by the kernel, so you can't use it
  1528. - group: 2
  1529. # netlink buffer size
  1530. buffer-size: 18432
  1531. # put default value here
  1532. - group: default
  1533. # set number of packet to queue inside kernel
  1534. qthreshold: 1
  1535. # set the delay before flushing packet in the queue inside kernel
  1536. qtimeout: 100
  1537. # netlink max buffer size
  1538. max-size: 20000
  1539.  
  1540. ##
  1541. ## Advanced Capture Options
  1542. ##
  1543.  
  1544. # general settings affecting packet capture
  1545. capture:
  1546. # disable NIC offloading. It's restored when Suricata exists.
  1547. # Enabled by default
  1548. #disable-offloading: false
  1549. #
  1550. # disable checksum validation. Same as setting '-k none' on the
  1551. # commandline
  1552. #checksum-validation: none
  1553.  
  1554. # Netmap support
  1555. #
  1556. # Netmap operates with NIC directly in driver, so you need FreeBSD wich have
  1557. # built-in netmap support or compile and install netmap module and appropriate
  1558. # NIC driver on your Linux system.
  1559. # To reach maximum throughput disable all receive-, segmentation-,
  1560. # checksum- offloadings on NIC.
  1561. # Disabling Tx checksum offloading is *required* for connecting OS endpoint
  1562. # with NIC endpoint.
  1563. # You can find more information at https://github.com/luigirizzo/netmap
  1564. #
  1565. netmap:
  1566. # To specify OS endpoint add plus sign at the end (e.g. "eth0+")
  1567. - interface: eth2
  1568. # Number of receive threads. "auto" uses number of RSS queues on interface.
  1569. #threads: auto
  1570. # You can use the following variables to activate netmap tap or IPS mode.
  1571. # If copy-mode is set to ips or tap, the traffic coming to the current
  1572. # interface will be copied to the copy-iface interface. If 'tap' is set, the
  1573. # copy is complete. If 'ips' is set, the packet matching a 'drop' action
  1574. # will not be copied.
  1575. # To specify the OS as the copy-iface (so the OS can route packets, or forward
  1576. # to a service running on the same machine) add a plus sign at the end
  1577. # (e.g. "copy-iface: eth0+"). Don't forget to set up a symmetrical eth0+ -> eth0
  1578. # for return packets. Hardware checksumming must be *off* on the interface if
  1579. # using an OS endpoint (e.g. 'ifconfig eth0 -rxcsum -txcsum -rxcsum6 -txcsum6' for FreeBSD
  1580. # or 'ethtool -K eth0 tx off rx off' for Linux).
  1581. #copy-mode: tap
  1582. #copy-iface: eth3
  1583. # Set to yes to disable promiscuous mode
  1584. # disable-promisc: no
  1585. # Choose checksum verification mode for the interface. At the moment
  1586. # of the capture, some packets may be with an invalid checksum due to
  1587. # offloading to the network card of the checksum computation.
  1588. # Possible values are:
  1589. # - yes: checksum validation is forced
  1590. # - no: checksum validation is disabled
  1591. # - auto: suricata uses a statistical approach to detect when
  1592. # checksum off-loading is used.
  1593. # Warning: 'checksum-validation' must be set to yes to have any validation
  1594. #checksum-checks: auto
  1595. # BPF filter to apply to this interface. The pcap filter syntax apply here.
  1596. #bpf-filter: port 80 or udp
  1597. #- interface: eth3
  1598. #threads: auto
  1599. #copy-mode: tap
  1600. #copy-iface: eth2
  1601. # Put default values here
  1602. - interface: default
  1603.  
  1604. # PF_RING configuration. for use with native PF_RING support
  1605. # for more info see http://www.ntop.org/products/pf_ring/
  1606. pfring:
  1607. - interface: eth0
  1608. # Number of receive threads (>1 will enable experimental flow pinned
  1609. # runmode)
  1610. threads: 1
  1611.  
  1612. # Default clusterid. PF_RING will load balance packets based on flow.
  1613. # All threads/processes that will participate need to have the same
  1614. # clusterid.
  1615. cluster-id: 99
  1616.  
  1617. # Default PF_RING cluster type. PF_RING can load balance per flow.
  1618. # Possible values are cluster_flow or cluster_round_robin.
  1619. cluster-type: cluster_flow
  1620. # bpf filter for this interface
  1621. #bpf-filter: tcp
  1622. # Choose checksum verification mode for the interface. At the moment
  1623. # of the capture, some packets may be with an invalid checksum due to
  1624. # offloading to the network card of the checksum computation.
  1625. # Possible values are:
  1626. # - rxonly: only compute checksum for packets received by network card.
  1627. # - yes: checksum validation is forced
  1628. # - no: checksum validation is disabled
  1629. # - auto: suricata uses a statistical approach to detect when
  1630. # checksum off-loading is used. (default)
  1631. # Warning: 'checksum-validation' must be set to yes to have any validation
  1632. #checksum-checks: auto
  1633. # Second interface
  1634. #- interface: eth1
  1635. # threads: 3
  1636. # cluster-id: 93
  1637. # cluster-type: cluster_flow
  1638. # Put default values here
  1639. - interface: default
  1640. #threads: 2
  1641.  
  1642. # For FreeBSD ipfw(8) divert(4) support.
  1643. # Please make sure you have ipfw_load="YES" and ipdivert_load="YES"
  1644. # in /etc/loader.conf or kldload'ing the appropriate kernel modules.
  1645. # Additionally, you need to have an ipfw rule for the engine to see
  1646. # the packets from ipfw. For Example:
  1647. #
  1648. # ipfw add 100 divert 8000 ip from any to any
  1649. #
  1650. # The 8000 above should be the same number you passed on the command
  1651. # line, i.e. -d 8000
  1652. #
  1653. ipfw:
  1654.  
  1655. # Reinject packets at the specified ipfw rule number. This config
  1656. # option is the ipfw rule number AT WHICH rule processing continues
  1657. # in the ipfw processing system after the engine has finished
  1658. # inspecting the packet for acceptance. If no rule number is specified,
  1659. # accepted packets are reinjected at the divert rule which they entered
  1660. # and IPFW rule processing continues. No check is done to verify
  1661. # this will rule makes sense so care must be taken to avoid loops in ipfw.
  1662. #
  1663. ## The following example tells the engine to reinject packets
  1664. # back into the ipfw firewall AT rule number 5500:
  1665. #
  1666. # ipfw-reinjection-rule-number: 5500
  1667.  
  1668.  
  1669. napatech:
  1670. # The Host Buffer Allowance for all streams
  1671. # (-1 = OFF, 1 - 100 = percentage of the host buffer that can be held back)
  1672. # This may be enabled when sharing streams with another application.
  1673. # Otherwise, it should be turned off.
  1674. hba: -1
  1675.  
  1676. # use_all_streams set to "yes" will query the Napatech service for all configured
  1677. # streams and listen on all of them. When set to "no" the streams config array
  1678. # will be used.
  1679. use-all-streams: yes
  1680.  
  1681. # The streams to listen on. This can be either:
  1682. # a list of individual streams (e.g. streams: [0,1,2,3])
  1683. # or
  1684. # a range of streams (e.g. streams: ["0-3"])
  1685. streams: ["0-3"]
  1686.  
  1687. # Tilera mpipe configuration. for use on Tilera TILE-Gx.
  1688. mpipe:
  1689.  
  1690. # Load balancing modes: "static", "dynamic", "sticky", or "round-robin".
  1691. load-balance: dynamic
  1692.  
  1693. # Number of Packets in each ingress packet queue. Must be 128, 512, 2028 or 65536
  1694. iqueue-packets: 2048
  1695.  
  1696. # List of interfaces we will listen on.
  1697. inputs:
  1698. - interface: xgbe2
  1699. - interface: xgbe3
  1700. - interface: xgbe4
  1701.  
  1702.  
  1703. # Relative weight of memory for packets of each mPipe buffer size.
  1704. stack:
  1705. size128: 0
  1706. size256: 9
  1707. size512: 0
  1708. size1024: 0
  1709. size1664: 7
  1710. size4096: 0
  1711. size10386: 0
  1712. size16384: 0
  1713.  
  1714. ##
  1715. ## Hardware accelaration
  1716. ##
  1717.  
  1718. # Cuda configuration.
  1719. cuda:
  1720. # The "mpm" profile. On not specifying any of these parameters, the engine's
  1721. # internal default values are used, which are same as the ones specified in
  1722. # in the default conf file.
  1723. mpm:
  1724. # The minimum length required to buffer data to the gpu.
  1725. # Anything below this is MPM'ed on the CPU.
  1726. # Can be specified in kb, mb, gb. Just a number indicates it's in bytes.
  1727. # A value of 0 indicates there's no limit.
  1728. data-buffer-size-min-limit: 0
  1729. # The maximum length for data that we would buffer to the gpu.
  1730. # Anything over this is MPM'ed on the CPU.
  1731. # Can be specified in kb, mb, gb. Just a number indicates it's in bytes.
  1732. data-buffer-size-max-limit: 1500
  1733. # The ring buffer size used by the CudaBuffer API to buffer data.
  1734. cudabuffer-buffer-size: 500mb
  1735. # The max chunk size that can be sent to the gpu in a single go.
  1736. gpu-transfer-size: 50mb
  1737. # The timeout limit for batching of packets in microseconds.
  1738. batching-timeout: 2000
  1739. # The device to use for the mpm. Currently we don't support load balancing
  1740. # on multiple gpus. In case you have multiple devices on your system, you
  1741. # can specify the device to use, using this conf. By default we hold 0, to
  1742. # specify the first device cuda sees. To find out device-id associated with
  1743. # the card(s) on the system run "suricata --list-cuda-cards".
  1744. device-id: 0
  1745. # No of Cuda streams used for asynchronous processing. All values > 0 are valid.
  1746. # For this option you need a device with Compute Capability > 1.0.
  1747. cuda-streams: 2
  1748.  
  1749. ##
  1750. ## Include other configs
  1751. ##
  1752.  
  1753. # Includes. Files included here will be handled as if they were
  1754. # inlined in this configuration file.
  1755. #include: include1.yaml
  1756. #include: include2.yaml
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!