poc2_worked

2026-08-15 18:29:36 +02:00
parent fc3a2944b2
commit 71b6c0d86f
62 changed files with 9112 additions and 375 deletions
@@ -0,0 +1,91 @@
+%YAML 1.1
+---
+# MikroSuricata IDS telemetry profile. This file is loaded after Debian's
+# suricata.yaml so the output contract stays stable across package upgrades.
+outputs:
+  # EVE already carries alerts; avoid duplicate fast.log writes.
+  - fast:
+      enabled: no
+      filename: fast.log
+      append: yes
+
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      community-id: true
+      community-id-seed: 0
+      pcap-file: false
+      metadata: yes
+      suricata-version: yes
+      ethernet: yes
+      types:
+        - alert:
+            tagged-packets: yes
+        - anomaly:
+            enabled: yes
+        - http:
+            extended: yes
+        - http2
+        - doh2
+        - dns:
+            version: 3
+            enabled: yes
+            requests: yes
+            responses: yes
+        - mdns
+        - tls:
+            extended: yes
+        - files:
+            force-magic: no
+            force-hash: [sha256]
+        - smtp:
+            extended: yes
+        - ftp
+        - websocket
+        - rdp
+        - nfs
+        - smb
+        - tftp
+        - dcerpc
+        - krb5
+        - snmp
+        - rfb
+        - sip
+        - ldap
+        - pop3
+        - ssh
+        - arp:
+            enabled: yes
+        - quic
+        - dhcp:
+            enabled: yes
+            extended: yes
+        - ike
+        - mqtt
+        - stats:
+            totals: yes
+            threads: no
+            deltas: no
+        - flow
+
+  # Bounded forensic capture: only flows that generated an alert are kept.
+  # The eight 64 MB files cap disk use at roughly 512 MB inside /data/logs/suricata.
+  - pcap-log:
+      enabled: yes
+      filename: alert.pcap
+      limit: 64
+      max-files: 8
+      compression: none
+      mode: normal
+      use-stream-depth: no
+      honor-pass-rules: yes
+      conditional: alerts
+
+  # Runtime stats are already emitted inside EVE and consumed by the app.
+  - stats:
+      enabled: no
+      filename: stats.log
+      append: yes
+      totals: yes
+      threads: no