gru/routeros-suricata-tzsp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

poc2_worked

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-08-15 18:29:36 +02:00
parent fc3a2944b2
commit 71b6c0d86f
62 changed files with 9112 additions and 375 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routeros/04-container-import-amd64.rsc
+22 -7
View File
@@ -7,7 +7,8 @@
/container/envs/add list=IDS_ENV key=TAP_NAME value=suritap0
/container/envs/add list=IDS_ENV key=TAP_MTU value=9000
/container/envs/add list=IDS_ENV key=SURICATA_HOME_NET value="[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
/container/envs/add list=IDS_ENV key=MONITORED_NETWORKS value=192.168.100.0/24
/container/envs/add list=IDS_ENV key=SURICATA_LOG_MAX_MB value=512
/container/envs/add list=IDS_ENV key=MONITORED_NETWORKS value=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
/container/envs/add list=IDS_ENV key=AUTO_BLOCK value=false
/container/envs/add list=IDS_ENV key=ROUTEROS_URL value=https://172.31.255.1
/container/envs/add list=IDS_ENV key=ROUTEROS_USER value=suricata-api
@@ -15,21 +16,35 @@
/container/envs/add list=IDS_ENV key=ROUTEROS_VERIFY_TLS value=false
/container/envs/add list=IDS_ENV key=ROUTEROS_ADDRESS_LIST value=IDS-BLOCK
/container/envs/add list=IDS_ENV key=UPDATE_RULES_ON_START value=false
/container/envs/add list=IDS_ENV key=SURICATA_PERSIST_LIB_DIR value=/data/lib/suricata
/container/envs/add list=IDS_ENV key=RULE_UPDATE_INTERVAL_HOURS value=24
/container/envs/add list=IDS_ENV key=ALERT_RETENTION_DAYS value=14
/container/envs/add list=IDS_ENV key=REDIS_URL value="redis://127.0.0.1:6379/0"
/container/envs/add list=IDS_ENV key=REDIS_MANAGED value=true
/container/envs/add list=IDS_ENV key=REDIS_DATA_DIR value=/data/redis
/container/envs/add list=IDS_ENV key=REDIS_PORT value=6379
/container/envs/add list=IDS_ENV key=REDIS_MAXMEMORY_MB value=0
/container/envs/add list=IDS_ENV key=REDIS_SNAPSHOT_SECONDS value=1800
/container/envs/add list=IDS_ENV key=TRAFFIC_RETENTION_HOURS value=24
/container/envs/add list=IDS_ENV key=TRAFFIC_MAX_EVENTS value=0
/container/envs/add list=IDS_ENV key=TRAFFIC_MEMORY_EVENTS value=0
/container/envs/add list=IDS_ENV key=WEBSOCKET_QUEUE_SIZE value=512
/container/envs/add list=IDS_ENV key=LIVE_FLOW_UPDATE_SECONDS value=2.0
/container/envs/add list=IDS_ENV key=ALERT_MAX_SEVERITY value=2
/container/envs/add list=IDS_ENV key=ALERT_DEDUP_WINDOW_SECONDS value=300
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_SIDS value=""
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_CATEGORIES value=""
# Set ADMIN_TOKEN to enable maintenance and rule-management buttons.
/container/envs/add list=IDS_ENV key=ADMIN_TOKEN value=""
# Set a long ADMIN_PASSWORD to enable authenticated maintenance/rule-management.
/container/envs/add list=IDS_ENV key=ADMIN_USERNAME value="admin"
/container/envs/add list=IDS_ENV key=ADMIN_PASSWORD value=""
/container/envs/add list=IDS_ENV key=SESSION_HOURS value=168
/container/envs/add list=IDS_ENV key=SESSION_COOKIE_SECURE value=false
/container/envs/add list=IDS_ENV key=ANALYTICS_SNAPSHOT_INTERVAL_SECONDS value=60
/container/mounts/remove [find where list="IDS_MOUNTS"]
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-data dst=/data
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-logs dst=/var/log/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-rules dst=/var/lib/suricata
/container/add file=routeros-suricata-tzsp-amd64.tar interface=veth-ids root-dir=/containers/suricata_0.5.3/root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata_0.5.3 start-on-boot=yes logging=yes
/container/add file=routeros-suricata-tzsp-amd64.tar interface=veth-ids root-dir=/containers/suricata_0.9.5/root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata_0.9.5 start-on-boot=yes logging=yes
# Wait until /container/print shows status=stopped, then:
# /container/start suricata_0.5.3
# /container/start suricata_0.9.5
routeros/04-container-import-arm.rsc
+22 -7
View File
@@ -7,7 +7,8 @@
/container/envs/add list=IDS_ENV key=TAP_NAME value=suritap0
/container/envs/add list=IDS_ENV key=TAP_MTU value=9000
/container/envs/add list=IDS_ENV key=SURICATA_HOME_NET value="[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
/container/envs/add list=IDS_ENV key=MONITORED_NETWORKS value=192.168.100.0/24
/container/envs/add list=IDS_ENV key=SURICATA_LOG_MAX_MB value=512
/container/envs/add list=IDS_ENV key=MONITORED_NETWORKS value=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
/container/envs/add list=IDS_ENV key=AUTO_BLOCK value=false
/container/envs/add list=IDS_ENV key=ROUTEROS_URL value=https://172.31.255.1
/container/envs/add list=IDS_ENV key=ROUTEROS_USER value=suricata-api
@@ -15,21 +16,35 @@
/container/envs/add list=IDS_ENV key=ROUTEROS_VERIFY_TLS value=false
/container/envs/add list=IDS_ENV key=ROUTEROS_ADDRESS_LIST value=IDS-BLOCK
/container/envs/add list=IDS_ENV key=UPDATE_RULES_ON_START value=false
/container/envs/add list=IDS_ENV key=SURICATA_PERSIST_LIB_DIR value=/data/lib/suricata
/container/envs/add list=IDS_ENV key=RULE_UPDATE_INTERVAL_HOURS value=24
/container/envs/add list=IDS_ENV key=ALERT_RETENTION_DAYS value=14
/container/envs/add list=IDS_ENV key=REDIS_URL value="redis://127.0.0.1:6379/0"
/container/envs/add list=IDS_ENV key=REDIS_MANAGED value=true
/container/envs/add list=IDS_ENV key=REDIS_DATA_DIR value=/data/redis
/container/envs/add list=IDS_ENV key=REDIS_PORT value=6379
/container/envs/add list=IDS_ENV key=REDIS_MAXMEMORY_MB value=0
/container/envs/add list=IDS_ENV key=REDIS_SNAPSHOT_SECONDS value=1800
/container/envs/add list=IDS_ENV key=TRAFFIC_RETENTION_HOURS value=24
/container/envs/add list=IDS_ENV key=TRAFFIC_MAX_EVENTS value=0
/container/envs/add list=IDS_ENV key=TRAFFIC_MEMORY_EVENTS value=0
/container/envs/add list=IDS_ENV key=WEBSOCKET_QUEUE_SIZE value=512
/container/envs/add list=IDS_ENV key=LIVE_FLOW_UPDATE_SECONDS value=2.0
/container/envs/add list=IDS_ENV key=ALERT_MAX_SEVERITY value=2
/container/envs/add list=IDS_ENV key=ALERT_DEDUP_WINDOW_SECONDS value=300
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_SIDS value=""
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_CATEGORIES value=""
# Set ADMIN_TOKEN to enable maintenance and rule-management buttons.
/container/envs/add list=IDS_ENV key=ADMIN_TOKEN value=""
# Set a long ADMIN_PASSWORD to enable authenticated maintenance/rule-management.
/container/envs/add list=IDS_ENV key=ADMIN_USERNAME value="admin"
/container/envs/add list=IDS_ENV key=ADMIN_PASSWORD value=""
/container/envs/add list=IDS_ENV key=SESSION_HOURS value=168
/container/envs/add list=IDS_ENV key=SESSION_COOKIE_SECURE value=false
/container/envs/add list=IDS_ENV key=ANALYTICS_SNAPSHOT_INTERVAL_SECONDS value=60
/container/mounts/remove [find where list="IDS_MOUNTS"]
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-data dst=/data
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-logs dst=/var/log/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-rules dst=/var/lib/suricata
/container/add file=routeros-suricata-tzsp-arm.tar interface=veth-ids root-dir=/containers/suricata_0.5.3/root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata_0.5.3 start-on-boot=yes logging=yes
/container/add file=routeros-suricata-tzsp-arm.tar interface=veth-ids root-dir=/containers/suricata_0.9.5/root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata_0.9.5 start-on-boot=yes logging=yes
# Wait until /container/print shows status=stopped, then:
# /container/start suricata_0.5.3
# /container/start suricata_0.9.5
routeros/04-container-import-arm64.rsc
+22 -7
View File
@@ -8,7 +8,8 @@
/container/envs/add list=IDS_ENV key=TAP_NAME value=suritap0
/container/envs/add list=IDS_ENV key=TAP_MTU value=9000
/container/envs/add list=IDS_ENV key=SURICATA_HOME_NET value="[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
/container/envs/add list=IDS_ENV key=MONITORED_NETWORKS value=192.168.100.0/24
/container/envs/add list=IDS_ENV key=SURICATA_LOG_MAX_MB value=512
/container/envs/add list=IDS_ENV key=MONITORED_NETWORKS value=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
/container/envs/add list=IDS_ENV key=AUTO_BLOCK value=false
/container/envs/add list=IDS_ENV key=ROUTEROS_URL value=https://172.31.255.1
/container/envs/add list=IDS_ENV key=ROUTEROS_USER value=suricata-api
@@ -16,21 +17,35 @@
/container/envs/add list=IDS_ENV key=ROUTEROS_VERIFY_TLS value=false
/container/envs/add list=IDS_ENV key=ROUTEROS_ADDRESS_LIST value=IDS-BLOCK
/container/envs/add list=IDS_ENV key=UPDATE_RULES_ON_START value=false
/container/envs/add list=IDS_ENV key=SURICATA_PERSIST_LIB_DIR value=/data/lib/suricata
/container/envs/add list=IDS_ENV key=RULE_UPDATE_INTERVAL_HOURS value=24
/container/envs/add list=IDS_ENV key=ALERT_RETENTION_DAYS value=14
/container/envs/add list=IDS_ENV key=REDIS_URL value="redis://127.0.0.1:6379/0"
/container/envs/add list=IDS_ENV key=REDIS_MANAGED value=true
/container/envs/add list=IDS_ENV key=REDIS_DATA_DIR value=/data/redis
/container/envs/add list=IDS_ENV key=REDIS_PORT value=6379
/container/envs/add list=IDS_ENV key=REDIS_MAXMEMORY_MB value=0
/container/envs/add list=IDS_ENV key=REDIS_SNAPSHOT_SECONDS value=1800
/container/envs/add list=IDS_ENV key=TRAFFIC_RETENTION_HOURS value=24
/container/envs/add list=IDS_ENV key=TRAFFIC_MAX_EVENTS value=0
/container/envs/add list=IDS_ENV key=TRAFFIC_MEMORY_EVENTS value=0
/container/envs/add list=IDS_ENV key=WEBSOCKET_QUEUE_SIZE value=512
/container/envs/add list=IDS_ENV key=LIVE_FLOW_UPDATE_SECONDS value=2.0
/container/envs/add list=IDS_ENV key=ALERT_MAX_SEVERITY value=2
/container/envs/add list=IDS_ENV key=ALERT_DEDUP_WINDOW_SECONDS value=300
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_SIDS value=""
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_CATEGORIES value=""
# Set ADMIN_TOKEN to enable maintenance and rule-management buttons.
/container/envs/add list=IDS_ENV key=ADMIN_TOKEN value=""
# Set a long ADMIN_PASSWORD to enable authenticated maintenance/rule-management.
/container/envs/add list=IDS_ENV key=ADMIN_USERNAME value="admin"
/container/envs/add list=IDS_ENV key=ADMIN_PASSWORD value=""
/container/envs/add list=IDS_ENV key=SESSION_HOURS value=168
/container/envs/add list=IDS_ENV key=SESSION_COOKIE_SECURE value=false
/container/envs/add list=IDS_ENV key=ANALYTICS_SNAPSHOT_INTERVAL_SECONDS value=60
/container/mounts/remove [find where list="IDS_MOUNTS"]
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-data dst=/data
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-logs dst=/var/log/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-rules dst=/var/lib/suricata
/container/add file=routeros-suricata-tzsp-arm64.tar interface=veth-ids root-dir=/containers/suricata_0.5.3/root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata_0.5.3 start-on-boot=yes logging=yes
/container/add file=routeros-suricata-tzsp-arm64.tar interface=veth-ids root-dir=/containers/suricata_0.9.5/root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata_0.9.5 start-on-boot=yes logging=yes
# Wait until /container/print shows status=stopped, then:
# /container/start suricata_0.5.3
# /container/start suricata_0.9.5
routeros/app-template.yml
+19 -2
View File
@@ -14,12 +14,29 @@ services:
- /dev/net/tun:/dev/net/tun
environment:
TZSP_PORT: "37008"
SURICATA_LOG_MAX_MB: "512"
TAP_NAME: suritap0
AUTO_BLOCK: "false"
MONITORED_NETWORKS: 192.168.100.0/24
MONITORED_NETWORKS: 192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
ALERT_MAX_SEVERITY: "2"
ALERT_DEDUP_WINDOW_SECONDS: "300"
ALERT_IGNORE_SIDS: ""
ALERT_IGNORE_CATEGORIES: ""
RULE_UPDATE_INTERVAL_HOURS: "24"
ADMIN_TOKEN: ""
SURICATA_PERSIST_LIB_DIR: /data/lib/suricata
REDIS_URL: redis://127.0.0.1:6379/0
REDIS_MANAGED: "true"
REDIS_DATA_DIR: /data/redis
REDIS_PORT: "6379"
REDIS_MAXMEMORY_MB: "0"
REDIS_SNAPSHOT_SECONDS: "1800"
TRAFFIC_RETENTION_HOURS: "24"
TRAFFIC_MAX_EVENTS: "0"
TRAFFIC_MEMORY_EVENTS: "0"
WEBSOCKET_QUEUE_SIZE: "512"
LIVE_FLOW_UPDATE_SECONDS: "2.0"
ADMIN_USERNAME: admin
ADMIN_PASSWORD: ""
SESSION_HOURS: "168"
SESSION_COOKIE_SECURE: "false"
ANALYTICS_SNAPSHOT_INTERVAL_SECONDS: "60"