CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-10 19:22:54 +01:00
Code Issues Packages Projects Releases Wiki Activity

adjust logging options

Browse Source
This commit is contained in:
Wes Lambert
2018-11-03 15:17:38 +00:00
parent a531dd6e52
commit 61802f7d62
1 changed files with 15 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
salt/suricata/files/suricata.yaml
View File

@@ -93,6 +93,7 @@ outputs:
enabled: yes enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json filename: eve.json
rotate-interval: day
#prefix: "@cee: " # prefix to prepend to each log entry #prefix: "@cee: " # prefix to prepend to each log entry
# the following are valid when type: syslog above # the following are valid when type: syslog above
#identity: "suricata" #identity: "suricata"
@@ -150,29 +151,29 @@ outputs:
# than one IP address is present, the last IP address will be the # than one IP address is present, the last IP address will be the
# one taken into consideration. # one taken into consideration.
header: X-Forwarded-For header: X-Forwarded-For
- http: #- http:
extended: no # enable this for extended logging information # extended: no # enable this for extended logging information
# custom allows additional http fields to be included in eve-log # custom allows additional http fields to be included in eve-log
# the example below adds three additional fields when uncommented # the example below adds three additional fields when uncommented
#custom: [Accept-Encoding, Accept-Language, Authorization] #custom: [Accept-Encoding, Accept-Language, Authorization]
- dns: #- dns:
# control logging of queries and answers # control logging of queries and answers
# default yes, no to disable # default yes, no to disable
query: no # enable logging of DNS queries # query: no # enable logging of DNS queries
answer: no # enable logging of DNS answers # answer: no # enable logging of DNS answers
# control which RR types are logged # control which RR types are logged
# all enabled if custom not specified # all enabled if custom not specified
#custom: [a, aaaa, cname, mx, ns, ptr, txt] #custom: [a, aaaa, cname, mx, ns, ptr, txt]
- tls: #- tls:
extended: no # enable this for extended logging information # extended: no # enable this for extended logging information
# output TLS transaction where the session is resumed using a # output TLS transaction where the session is resumed using a
# session id # session id
#session-resumption: no #session-resumption: no
# custom allows to control which tls fields that are included # custom allows to control which tls fields that are included
# in eve-log # in eve-log
#custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain] #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain]
- files: #- files:
force-magic: no # force logging magic on all logged files # force-magic: no # force logging magic on all logged files
# force logging of checksums, available hash functions are md5, # force logging of checksums, available hash functions are md5,
# sha1 and sha256 # sha1 and sha256
#force-hash: [md5] #force-hash: [md5]
@@ -180,7 +181,7 @@ outputs:
# alerts: yes # log alerts that caused drops # alerts: yes # log alerts that caused drops
# flows: all # start or all: 'start' logs only a single drop # flows: all # start or all: 'start' logs only a single drop
# # per flow direction. All logs each dropped pkt. # # per flow direction. All logs each dropped pkt.
- smtp: #- smtp:
#extended: yes # enable this for extended logging information #extended: yes # enable this for extended logging information
# this includes: bcc, message-id, subject, x_mailer, user-agent # this includes: bcc, message-id, subject, x_mailer, user-agent
# custom fields logging from the list: # custom fields logging from the list:
@@ -196,10 +197,10 @@ outputs:
#- dnp3 #- dnp3
#- nfs #- nfs
#- ssh: #- ssh:
- stats: #- stats:
totals: yes # stats for all threads merged together # totals: yes # stats for all threads merged together
threads: no # per thread stats # threads: no # per thread stats
deltas: no # include delta values # deltas: no # include delta values
# bi-directional flows # bi-directional flows
#- flow: #- flow:
# uni-directional flows # uni-directional flows