91 lines
1.7 KiB
YAML
Executable file
91 lines
1.7 KiB
YAML
Executable file
%YAML 1.1
|
|
---
|
|
# Suricata configuration file
|
|
|
|
vars:
|
|
address-groups:
|
|
HOME_NET: "[192.168.0.0/16]"
|
|
EXTERNAL_NET: "any"
|
|
|
|
port-groups:
|
|
HTTP_PORTS: "80"
|
|
|
|
# Define Suricata as an inline IPS
|
|
af-packet:
|
|
- interface: wlan0
|
|
threads: auto
|
|
cluster-id: 99
|
|
cluster-type: cluster_flow
|
|
defrag: yes
|
|
bypass: no
|
|
|
|
# Define network capture method
|
|
pcap:
|
|
- interface: wlan0
|
|
buffer-size: 512mb
|
|
|
|
ips:
|
|
mode: "inline"
|
|
default-rule-action: "drop"
|
|
|
|
outputs:
|
|
- fast:
|
|
enabled: yes
|
|
filename: "/var/log/suricata/fast.log"
|
|
- eve-log:
|
|
enabled: yes
|
|
filetype: regular
|
|
filename: "/var/log/suricata/eve.json"
|
|
types:
|
|
- http:
|
|
extended: yes # Log full request details
|
|
body: yes # Log request body
|
|
|
|
- pcap-log:
|
|
enabled: yes
|
|
dir: "/var/log/suricata/pcap"
|
|
filename: "full-packet-log.pcap"
|
|
- stats:
|
|
enabled: yes
|
|
filename: "/var/log/suricata/stats.log"
|
|
append: yes
|
|
totals: yes
|
|
threads: yes
|
|
|
|
# Define the HTTP inspection settings
|
|
app-layer:
|
|
protocols:
|
|
http:
|
|
enabled: yes
|
|
libhtp:
|
|
default-config:
|
|
personality: IDS
|
|
request-body-limit: 4096
|
|
response-body-limit: 4096
|
|
request-body-minimal-inspect-size: 512
|
|
response-body-minimal-inspect-size: 512
|
|
request-body-inspect-window: 4096
|
|
response-body-inspect-window: 4096
|
|
|
|
logging:
|
|
outputs:
|
|
- console:
|
|
enabled: yes
|
|
- file:
|
|
enabled: yes
|
|
filename: "/var/log/suricata/suricata.log"
|
|
|
|
stats:
|
|
enabled: yes
|
|
interval: 30
|
|
|
|
unix-command:
|
|
enabled: yes
|
|
filename: suricata-command.socket
|
|
|
|
# Enable rule management
|
|
default-rule-path: /etc/suricata/rules
|
|
|
|
rule-files:
|
|
- suricata.rules
|