gru/routeros-suricata-tzsp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

worked poc

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-08-14 11:33:01 +02:00
parent adfdb0b86c
commit fc3a2944b2
94 changed files with 2931 additions and 3412 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/config.py
+39
View File
@@ -26,12 +26,21 @@ class Config:
tap_mtu: int
suricata_config: str
suricata_home_net: str
suricata_local_rules: str
suricata_extra_rules_glob: str
suricata_custom_rules: str
suricata_threshold_config: str
update_rules_on_start: bool
rule_update_interval_hours: int
web_bind: str
web_port: int
db_path: str
eve_path: str
alert_retention_days: int
alert_max_severity: int
alert_dedup_window_seconds: int
alert_ignore_sids: str
alert_ignore_categories: str
auto_block: bool
auto_block_max_severity: int
monitored_networks: str
@@ -43,6 +52,7 @@ class Config:
routeros_verify_tls: bool
routeros_address_list: str
routeros_http_timeout: int
admin_token: str
@classmethod
def from_env(cls) -> "Config":
@@ -56,12 +66,32 @@ class Config:
"SURICATA_HOME_NET",
"[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]",
),
suricata_local_rules=os.getenv(
"SURICATA_LOCAL_RULES", "/data/suricata/local.rules"
),
suricata_extra_rules_glob=os.getenv(
"SURICATA_EXTRA_RULES_GLOB", "/data/suricata/*.rules"
),
suricata_custom_rules=os.getenv(
"SURICATA_CUSTOM_RULES", "/data/suricata/custom.rules"
),
suricata_threshold_config=os.getenv(
"SURICATA_THRESHOLD_CONFIG", "/data/suricata/threshold.config"
),
update_rules_on_start=_bool("UPDATE_RULES_ON_START", False),
rule_update_interval_hours=_int("RULE_UPDATE_INTERVAL_HOURS", 24),
web_bind=os.getenv("WEB_BIND", "0.0.0.0"),
web_port=_int("WEB_PORT", 8080),
db_path=os.getenv("DB_PATH", "/data/ids.db"),
eve_path=os.getenv("EVE_PATH", "/var/log/suricata/eve.json"),
alert_retention_days=_int("ALERT_RETENTION_DAYS", 14),
# Suricata severity uses 1 as the most important value. Keeping
# 1-2 by default removes low-priority informational noise from the
# incident database while raw EVE remains available on disk.
alert_max_severity=_int("ALERT_MAX_SEVERITY", 2),
alert_dedup_window_seconds=_int("ALERT_DEDUP_WINDOW_SECONDS", 300),
alert_ignore_sids=os.getenv("ALERT_IGNORE_SIDS", "1000001"),
alert_ignore_categories=os.getenv("ALERT_IGNORE_CATEGORIES", ""),
auto_block=_bool("AUTO_BLOCK", False),
auto_block_max_severity=_int("AUTO_BLOCK_MAX_SEVERITY", 1),
monitored_networks=os.getenv("MONITORED_NETWORKS", "192.168.100.0/24"),
@@ -73,6 +103,7 @@ class Config:
routeros_verify_tls=_bool("ROUTEROS_VERIFY_TLS", False),
routeros_address_list=os.getenv("ROUTEROS_ADDRESS_LIST", "IDS-BLOCK"),
routeros_http_timeout=_int("ROUTEROS_HTTP_TIMEOUT", 5),
admin_token=os.getenv("ADMIN_TOKEN", ""),
)
def public_dict(self) -> dict:
@@ -82,7 +113,14 @@ class Config:
"tap_name": self.tap_name,
"tap_mtu": self.tap_mtu,
"suricata_home_net": self.suricata_home_net,
"suricata_extra_rules_glob": self.suricata_extra_rules_glob,
"web_port": self.web_port,
"rule_update_interval_hours": self.rule_update_interval_hours,
"alert_retention_days": self.alert_retention_days,
"alert_max_severity": self.alert_max_severity,
"alert_dedup_window_seconds": self.alert_dedup_window_seconds,
"alert_ignore_sids": self.alert_ignore_sids,
"alert_ignore_categories": self.alert_ignore_categories,
"auto_block": self.auto_block,
"auto_block_max_severity": self.auto_block_max_severity,
"monitored_networks": self.monitored_networks,
@@ -92,4 +130,5 @@ class Config:
"routeros_user": self.routeros_user,
"routeros_verify_tls": self.routeros_verify_tls,
"routeros_address_list": self.routeros_address_list,
"admin_actions_enabled": bool(self.admin_token),
}