mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-05-05 19:08:10 +02:00
m0duspwnens
136 lines
6.1 KiB
YAML
136 lines
6.1 KiB
YAML
suricata:
|
|
lookup:
|
|
outputs:
|
|
- eve-log:
|
|
- anomaly:
|
|
# Anomaly log records describe unexpected conditions such
|
|
# as truncated packets, packets with invalid IP/UDP/TCP
|
|
# length values, and other events that render the packet
|
|
# invalid for further processing or describe unexpected
|
|
# behavior on an established stream. Networks which
|
|
# experience high occurrences of anomalies may experience
|
|
# packet processing degradation.
|
|
#
|
|
# Anomalies are reported for the following:
|
|
# 1. Decode: Values and conditions that are detected while
|
|
# decoding individual packets. This includes invalid or
|
|
# unexpected values for low-level protocol lengths as well
|
|
# as stream related events (TCP 3-way handshake issues,
|
|
# unexpected sequence number, etc).
|
|
# 2. Stream: This includes stream related events (TCP
|
|
# 3-way handshake issues, unexpected sequence number,
|
|
# etc).
|
|
# 3. Application layer: These denote application layer
|
|
# specific conditions that are unexpected, invalid or are
|
|
# unexpected given the application monitoring state.
|
|
#
|
|
# By default, anomaly logging is disabled. When anomaly
|
|
# logging is enabled, applayer anomaly reporting is
|
|
# enabled.
|
|
enabled: "no"
|
|
#
|
|
# Choose one or more types of anomaly logging and whether to enable
|
|
# logging of the packet header for packet anomalies.
|
|
types:
|
|
decode: "no"
|
|
stream: "no"
|
|
applayer: "yes"
|
|
packethdr: "no"
|
|
- http:
|
|
extended: "yes" # enable this for extended logging information
|
|
# custom allows additional http fields to be included in eve-log
|
|
# the example below adds three additional fields when uncommented
|
|
#custom: [Accept-Encoding, Accept-Language, Authorization]
|
|
# set this value to one and only one among {both, request, response}
|
|
# to dump all http headers for every http request and/or response
|
|
# dump-all-headers: none
|
|
- dns:
|
|
# This configuration uses the new DNS logging format,
|
|
# the old configuration is still available:
|
|
# https://suricata.readthedocs.io/en/latest/output/eve/eve-json-output.html#dns-v1-format
|
|
|
|
# As of Suricata 5.0, version 2 of the eve dns output
|
|
# format is the default.
|
|
version: 2
|
|
|
|
# Enable/disable this logger. Default: enabled.
|
|
enabled: "yes"
|
|
|
|
# Control logging of requests and responses:
|
|
# - requests: enable logging of DNS queries
|
|
# - responses: enable logging of DNS answers
|
|
# By default both requests and responses are logged.
|
|
#requests: "no"
|
|
#responses: "no"
|
|
|
|
# Format of answer logging:
|
|
# - detailed: array item per answer
|
|
# - grouped: answers aggregated by type
|
|
# Default: all
|
|
#formats: [detailed, grouped]
|
|
|
|
# Types to log, based on the query type.
|
|
# Default: all.
|
|
#types: [a, aaaa, cname, mx, ns, ptr, txt]
|
|
- tls:
|
|
extended: "yes" # enable this for extended logging information
|
|
# output TLS transaction where the session is resumed using a
|
|
# session id
|
|
#session-resumption: "no"
|
|
# custom allows to control which tls fields that are included
|
|
# in eve-log
|
|
#custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3, ja3s]
|
|
- files:
|
|
force-magic: "no" # force logging magic on all logged files
|
|
# force logging of checksums, available hash functions are md5,
|
|
# sha1 and sha256
|
|
#force-hash: [md5]
|
|
#- drop:
|
|
# alerts: "yes" # log alerts that caused drops
|
|
# flows: all # start or all: 'start' logs only a single drop
|
|
# # per flow direction. All logs each dropped pkt.
|
|
|
|
- smtp:
|
|
extended: "yes" # enable this for extended logging information
|
|
# this includes: bcc, message-id, subject, x_mailer, user-agent
|
|
# custom fields logging from the list:
|
|
# reply-to, bcc, message-id, subject, x-mailer, user-agent, received,
|
|
# x-originating-ip, in-reply-to, references, importance, priority,
|
|
# sensitivity, organization, content-md5, date
|
|
#custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
|
|
# output md5 of fields: body, subject
|
|
# for the body you need to set app-layer.protocols.smtp.mime.body-md5
|
|
# to yes
|
|
#md5: [body, subject]
|
|
|
|
- dnp3
|
|
- ftp
|
|
- rdp
|
|
- nfs
|
|
- smb
|
|
- tftp
|
|
- ikev2
|
|
- krb5
|
|
- snmp
|
|
- sip
|
|
- dhcp:
|
|
enabled: "yes"
|
|
# When extended mode is on, all DHCP messages are logged
|
|
# with full detail. When extended mode is off (the
|
|
# default), just enough information to map a MAC address
|
|
# to an IP address is logged.
|
|
# extended: "no"
|
|
- ssh
|
|
#- stats:
|
|
# totals: "yes" # stats for all threads merged together
|
|
# threads: "no" # per thread stats
|
|
# deltas: "no" # include delta values
|
|
# bi-directional flows
|
|
- flow
|
|
# uni-directional flows
|
|
#- netflow
|
|
|
|
# Metadata event type. Triggered whenever a pktvar is saved
|
|
# and will include the pktvars, flowvars, flowbits and
|
|
# flowints.
|
|
#- metadata |