Re: [PATCH] suricata.yaml: Re-add EVE log section.

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 11527 bytes --]

Acked-by: Michael Tremer <michael.tremer(a)ipfire.org>

> On 5 Apr 2020, at 12:03, Stefan Schantl <stefan.schantl(a)ipfire.org> wrote:
> 
> Hopefully the EVE log will display some more content when trying to
> debug suricata events and rules.
> 
> Fixes #12315.
> 
> Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
> ---
> config/suricata/suricata.yaml | 209 ++++++++++++++++++++++++++++++++++
> 1 file changed, 209 insertions(+)
> 
> diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
> index 973b2686c..1f33ea0f3 100644
> --- a/config/suricata/suricata.yaml
> +++ b/config/suricata/suricata.yaml
> @@ -92,6 +92,215 @@ outputs:
>       threads: no       # per thread stats
>       #null-values: yes  # print counters that have value 0
> 
> +  # Extensible Event Format (nicknamed EVE) event log in JSON format
> +  - eve-log:
> +      enabled: no
> +      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
> +      filename: eve.json
> +      #prefix: "@cee: " # prefix to prepend to each log entry
> +      # the following are valid when type: syslog above
> +      #identity: "suricata"
> +      #facility: local5
> +      #level: Info ## possible levels: Emergency, Alert, Critical,
> +                   ## Error, Warning, Notice, Info, Debug
> +      #redis:
> +      #  server: 127.0.0.1
> +      #  port: 6379
> +      #  async: true ## if redis replies are read asynchronously
> +      #  mode: list ## possible values: list|lpush (default), rpush, channel|publish
> +      #             ## lpush and rpush are using a Redis list. "list" is an alias for lpush
> +      #             ## publish is using a Redis channel. "channel" is an alias for publish
> +      #  key: suricata ## key or channel to use (default to suricata)
> +      # Redis pipelining set up. This will enable to only do a query every
> +      # 'batch-size' events. This should lower the latency induced by network
> +      # connection at the cost of some memory. There is no flushing implemented
> +      # so this setting as to be reserved to high traffic suricata.
> +      #  pipelining:
> +      #    enabled: yes ## set enable to yes to enable query pipelining
> +      #    batch-size: 10 ## number of entry to keep in buffer
> +
> +      # Include top level metadata. Default yes.
> +      #metadata: no
> +
> +      # include the name of the input pcap file in pcap file processing mode
> +      pcap-file: false
> +
> +      # Community Flow ID
> +      # Adds a 'community_id' field to EVE records. These are meant to give
> +      # a records a predictable flow id that can be used to match records to
> +      # output of other tools such as Bro.
> +      #
> +      # Takes a 'seed' that needs to be same across sensors and tools
> +      # to make the id less predictable.
> +
> +      # enable/disable the community id feature.
> +      community-id: false
> +      # Seed value for the ID output. Valid values are 0-65535.
> +      community-id-seed: 0
> +
> +      # HTTP X-Forwarded-For support by adding an extra field or overwriting
> +      # the source or destination IP address (depending on flow direction)
> +      # with the one reported in the X-Forwarded-For HTTP header. This is
> +      # helpful when reviewing alerts for traffic that is being reverse
> +      # or forward proxied.
> +      xff:
> +        enabled: no
> +        # Two operation modes are available, "extra-data" and "overwrite".
> +        mode: extra-data
> +        # Two proxy deployments are supported, "reverse" and "forward". In
> +        # a "reverse" deployment the IP address used is the last one, in a
> +        # "forward" deployment the first IP address is used.
> +        deployment: reverse
> +        # Header name where the actual IP address will be reported, if more
> +        # than one IP address is present, the last IP address will be the
> +        # one taken into consideration.
> +        header: X-Forwarded-For
> +
> +      types:
> +        - alert:
> +            # payload: yes             # enable dumping payload in Base64
> +            # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
> +            # payload-printable: yes   # enable dumping payload in printable (lossy) format
> +            # packet: yes              # enable dumping of packet (without stream segments)
> +            # metadata: no             # enable inclusion of app layer metadata with alert. Default yes
> +            # http-body: yes           # Requires metadata; enable dumping of http body in Base64
> +            # http-body-printable: yes # Requires metadata; enable dumping of http body in printable format
> +
> +            # Enable the logging of tagged packets for rules using the
> +            # "tag" keyword.
> +            tagged-packets: yes
> +        - anomaly:
> +            # Anomaly log records describe unexpected conditions such
> +            # as truncated packets, packets with invalid IP/UDP/TCP
> +            # length values, and other events that render the packet
> +            # invalid for further processing or describe unexpected
> +            # behavior on an established stream. Networks which
> +            # experience high occurrences of anomalies may experience
> +            # packet processing degradation.
> +            #
> +            # Anomalies are reported for the following:
> +            # 1. Decode: Values and conditions that are detected while
> +            # decoding individual packets. This includes invalid or
> +            # unexpected values for low-level protocol lengths as well
> +            # as stream related events (TCP 3-way handshake issues,
> +            # unexpected sequence number, etc).
> +            # 2. Stream: This includes stream related events (TCP
> +            # 3-way handshake issues, unexpected sequence number,
> +            # etc).
> +            # 3. Application layer: These denote application layer
> +            # specific conditions that are unexpected, invalid or are
> +            # unexpected given the application monitoring state.
> +            #
> +            # By default, anomaly logging is disabled. When anomaly
> +            # logging is enabled, applayer anomaly reporting is
> +            # enabled.
> +            enabled: yes
> +            #
> +            # Choose one or more types of anomaly logging and whether to enable
> +            # logging of the packet header for packet anomalies.
> +            types:
> +              # decode: no
> +              # stream: no
> +              # applayer: yes
> +            #packethdr: no
> +        - http:
> +            extended: yes     # enable this for extended logging information
> +            # custom allows additional http fields to be included in eve-log
> +            # the example below adds three additional fields when uncommented
> +            #custom: [Accept-Encoding, Accept-Language, Authorization]
> +            # set this value to one and only one among {both, request, response}
> +            # to dump all http headers for every http request and/or response
> +            # dump-all-headers: none
> +        - dns:
> +            # This configuration uses the new DNS logging format,
> +            # the old configuration is still available:
> +            # https://suricata.readthedocs.io/en/latest/output/eve/eve-json-output.html#dns-v1-format
> +
> +            # As of Suricata 5.0, version 2 of the eve dns output
> +            # format is the default.
> +            #version: 2
> +
> +            # Enable/disable this logger. Default: enabled.
> +            #enabled: yes
> +
> +            # Control logging of requests and responses:
> +            # - requests: enable logging of DNS queries
> +            # - responses: enable logging of DNS answers
> +            # By default both requests and responses are logged.
> +            #requests: no
> +            #responses: no
> +
> +            # Format of answer logging:
> +            # - detailed: array item per answer
> +            # - grouped: answers aggregated by type
> +            # Default: all
> +            #formats: [detailed, grouped]
> +
> +            # Types to log, based on the query type.
> +            # Default: all.
> +            #types: [a, aaaa, cname, mx, ns, ptr, txt]
> +        - tls:
> +            extended: yes     # enable this for extended logging information
> +            # output TLS transaction where the session is resumed using a
> +            # session id
> +            #session-resumption: no
> +            # custom allows to control which tls fields that are included
> +            # in eve-log
> +            #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3, ja3s]
> +        - files:
> +            force-magic: no   # force logging magic on all logged files
> +            # force logging of checksums, available hash functions are md5,
> +            # sha1 and sha256
> +            #force-hash: [md5]
> +        #- drop:
> +        #    alerts: yes      # log alerts that caused drops
> +        #    flows: all       # start or all: 'start' logs only a single drop
> +        #                     # per flow direction. All logs each dropped pkt.
> +        - smtp:
> +            #extended: yes # enable this for extended logging information
> +            # this includes: bcc, message-id, subject, x_mailer, user-agent
> +            # custom fields logging from the list:
> +            #  reply-to, bcc, message-id, subject, x-mailer, user-agent, received,
> +            #  x-originating-ip, in-reply-to, references, importance, priority,
> +            #  sensitivity, organization, content-md5, date
> +            #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
> +            # output md5 of fields: body, subject
> +            # for the body you need to set app-layer.protocols.smtp.mime.body-md5
> +            # to yes
> +            #md5: [body, subject]
> +
> +        #- dnp3
> +        - ftp
> +        #- rdp
> +        - nfs
> +        - smb
> +        - tftp
> +        - ikev2
> +        - krb5
> +        - snmp
> +        #- sip
> +        - dhcp:
> +            enabled: yes
> +            # When extended mode is on, all DHCP messages are logged
> +            # with full detail. When extended mode is off (the
> +            # default), just enough information to map a MAC address
> +            # to an IP address is logged.
> +            extended: no
> +        - ssh
> +        - stats:
> +            totals: yes       # stats for all threads merged together
> +            threads: no       # per thread stats
> +            deltas: no        # include delta values
> +        # bi-directional flows
> +        - flow
> +        # uni-directional flows
> +        #- netflow
> +
> +        # Metadata event type. Triggered whenever a pktvar is saved
> +        # and will include the pktvars, flowvars, flowbits and
> +        # flowints.
> +        #- metadata
> +
> logging:
>   # The default log level, can be overridden in an output section.
>   # Note that debug level logging will only be emitted if Suricata was
> -- 
> 2.26.0
>