poc2_worked

Dockerfile

@@ -10,15 +10,17 @@ RUN printf '%s\n' \
       'path-exclude=/usr/share/info/*' \
       'path-exclude=/usr/share/locale/*' \
       > /etc/dpkg/dpkg.cfg.d/01_nodoc \
+    && printf '%s\n' 'deb http://deb.debian.org/debian trixie-backports main' > /etc/apt/sources.list.d/trixie-backports.list \
     && apt-get update \
     && apt-get install -y --no-install-recommends \
        ca-certificates \
        iproute2 \
        passwd \
        python3 \
-       suricata \
+       redis-server \
        suricata-update \
        tini \
+    && apt-get install -y --no-install-recommends -t trixie-backports suricata \
     && if ! getent group suricata >/dev/null 2>&1; then groupadd --system suricata; fi \
     && if ! id -u suricata >/dev/null 2>&1; then useradd --system --gid suricata --home-dir /var/lib/suricata --no-create-home --shell /usr/sbin/nologin suricata; fi \
     && getent passwd suricata >/dev/null \
@@ -48,9 +50,13 @@ RUN chmod +x /opt/ids/scripts/*.sh \
     && mkdir -p /data /var/log/suricata /var/lib/suricata/rules /run/suricata /tmp/suricata-build-test \
     && suricata -T \
        -c /etc/suricata/suricata.yaml \
+       --include /opt/ids/suricata/ids-output.yaml \
        -l /tmp/suricata-build-test \
        -s /opt/ids/suricata/local.rules \
        --set 'vars.address-groups.HOME_NET=[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]' \
+       --set 'app-layer.protocols.tls.ja3-fingerprints=yes' \
+       --set 'app-layer.protocols.tls.ja4-fingerprints=yes' \
+       --set 'app-layer.protocols.ssh.hassh=yes' \
     && rm -rf /tmp/suricata-build-test \
     && chown -R suricata:suricata /var/log/suricata /var/lib/suricata /run/suricata
 
@@ -62,17 +68,45 @@ ENV PYTHONUNBUFFERED=1 \
     WEB_BIND=0.0.0.0 \
     WEB_PORT=8080 \
     DB_PATH=/data/ids.db \
-    EVE_PATH=/var/log/suricata/eve.json \
+    EVE_PATH=/data/logs/suricata/eve.json \
+    SURICATA_LOG_MAX_MB=512 \
+    SURICATA_OUTPUT_CONFIG=/opt/ids/suricata/ids-output.yaml \
     SURICATA_LOCAL_RULES=/data/suricata/local.rules \
     SURICATA_EXTRA_RULES_GLOB=/data/suricata/*.rules \
     SURICATA_CUSTOM_RULES=/data/suricata/custom.rules \
     SURICATA_THRESHOLD_CONFIG=/data/suricata/threshold.config \
+    SURICATA_PERSIST_LIB_DIR=/data/lib/suricata \
     ALERT_MAX_SEVERITY=2 \
     ALERT_DEDUP_WINDOW_SECONDS=300 \
     ALERT_IGNORE_SIDS=1000001 \
+    ADMIN_USERNAME=admin \
+    ADMIN_PASSWORD= \
+    SESSION_HOURS=168 \
+    SESSION_COOKIE_SECURE=false \
+    ANALYTICS_SNAPSHOT_INTERVAL_SECONDS=60 \
     AUTO_BLOCK=false \
     UPDATE_RULES_ON_START=false \
-    RULE_UPDATE_INTERVAL_HOURS=24
+    RULE_UPDATE_INTERVAL_HOURS=24 \
+    REDIS_URL=redis://127.0.0.1:6379/0 \
+    REDIS_MANAGED=true \
+    REDIS_DATA_DIR=/data/redis \
+    REDIS_PORT=6379 \
+    REDIS_MAXMEMORY_MB=0 \
+    REDIS_SNAPSHOT_SECONDS=1800 \
+    REDIS_AOF=true \
+    TRAFFIC_RETENTION_HOURS=24 \
+    TRAFFIC_MAX_EVENTS=0 \
+    TRAFFIC_MEMORY_EVENTS=0 \
+    WEBSOCKET_QUEUE_SIZE=512 \
+    LIVE_FLOW_UPDATE_SECONDS=2.0 \
+    NDR_ENABLED=true \
+    NDR_CORRELATION_WINDOW_SECONDS=1800 \
+    BEHAVIOR_MIN_OBSERVATIONS=50 \
+    NDR_AUTO_BLOCK=false \
+    NDR_AUTO_BLOCK_RISK=92 \
+    ROUTEROS_INVENTORY_INTERVAL_SECONDS=300 \
+    NOTIFY_MIN_RISK=80 \
+    NOTIFY_TIMEOUT_SECONDS=5
 
 EXPOSE 37008/udp 8080/tcp