gru/routeros-suricata-tzsp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

worked poc

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-08-14 11:33:01 +02:00
parent adfdb0b86c
commit fc3a2944b2
94 changed files with 2931 additions and 3412 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routeros/04-container-import-amd64.rsc
+13 -5
View File
@@ -15,13 +15,21 @@
/container/envs/add list=IDS_ENV key=ROUTEROS_VERIFY_TLS value=false
/container/envs/add list=IDS_ENV key=ROUTEROS_ADDRESS_LIST value=IDS-BLOCK
/container/envs/add list=IDS_ENV key=UPDATE_RULES_ON_START value=false
/container/envs/add list=IDS_ENV key=RULE_UPDATE_INTERVAL_HOURS value=24
/container/envs/add list=IDS_ENV key=ALERT_RETENTION_DAYS value=14
/container/envs/add list=IDS_ENV key=ALERT_MAX_SEVERITY value=2
/container/envs/add list=IDS_ENV key=ALERT_DEDUP_WINDOW_SECONDS value=300
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_SIDS value=""
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_CATEGORIES value=""
# Set ADMIN_TOKEN to enable maintenance and rule-management buttons.
/container/envs/add list=IDS_ENV key=ADMIN_TOKEN value=""
/container/mounts/remove [find where list="IDS_MOUNTS"]
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-data dst=/data
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-logs dst=/var/log/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-rules dst=/var/lib/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-data dst=/data
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-logs dst=/var/log/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-rules dst=/var/lib/suricata
/container/add file=disk1/routeros-suricata-tzsp-amd64.tar interface=veth-ids root-dir=disk1/containers/suricata-ids-root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata-ids start-on-boot=yes logging=yes
/container/add file=routeros-suricata-tzsp-amd64.tar interface=veth-ids root-dir=/containers/suricata_0.5.3/root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata_0.5.3 start-on-boot=yes logging=yes
# Wait until /container/print shows status=stopped, then:
# /container/start suricata-ids
# /container/start suricata_0.5.3
routeros/04-container-import-arm.rsc
+13 -5
View File
@@ -15,13 +15,21 @@
/container/envs/add list=IDS_ENV key=ROUTEROS_VERIFY_TLS value=false
/container/envs/add list=IDS_ENV key=ROUTEROS_ADDRESS_LIST value=IDS-BLOCK
/container/envs/add list=IDS_ENV key=UPDATE_RULES_ON_START value=false
/container/envs/add list=IDS_ENV key=RULE_UPDATE_INTERVAL_HOURS value=24
/container/envs/add list=IDS_ENV key=ALERT_RETENTION_DAYS value=14
/container/envs/add list=IDS_ENV key=ALERT_MAX_SEVERITY value=2
/container/envs/add list=IDS_ENV key=ALERT_DEDUP_WINDOW_SECONDS value=300
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_SIDS value=""
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_CATEGORIES value=""
# Set ADMIN_TOKEN to enable maintenance and rule-management buttons.
/container/envs/add list=IDS_ENV key=ADMIN_TOKEN value=""
/container/mounts/remove [find where list="IDS_MOUNTS"]
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-data dst=/data
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-logs dst=/var/log/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-rules dst=/var/lib/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-data dst=/data
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-logs dst=/var/log/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-rules dst=/var/lib/suricata
/container/add file=disk1/routeros-suricata-tzsp-arm.tar interface=veth-ids root-dir=disk1/containers/suricata-ids-root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata-ids start-on-boot=yes logging=yes
/container/add file=routeros-suricata-tzsp-arm.tar interface=veth-ids root-dir=/containers/suricata_0.5.3/root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata_0.5.3 start-on-boot=yes logging=yes
# Wait until /container/print shows status=stopped, then:
# /container/start suricata-ids
# /container/start suricata_0.5.3
routeros/04-container-import-arm64.rsc
+13 -5
View File
@@ -16,13 +16,21 @@
/container/envs/add list=IDS_ENV key=ROUTEROS_VERIFY_TLS value=false
/container/envs/add list=IDS_ENV key=ROUTEROS_ADDRESS_LIST value=IDS-BLOCK
/container/envs/add list=IDS_ENV key=UPDATE_RULES_ON_START value=false
/container/envs/add list=IDS_ENV key=RULE_UPDATE_INTERVAL_HOURS value=24
/container/envs/add list=IDS_ENV key=ALERT_RETENTION_DAYS value=14
/container/envs/add list=IDS_ENV key=ALERT_MAX_SEVERITY value=2
/container/envs/add list=IDS_ENV key=ALERT_DEDUP_WINDOW_SECONDS value=300
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_SIDS value=""
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_CATEGORIES value=""
# Set ADMIN_TOKEN to enable maintenance and rule-management buttons.
/container/envs/add list=IDS_ENV key=ADMIN_TOKEN value=""
/container/mounts/remove [find where list="IDS_MOUNTS"]
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-data dst=/data
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-logs dst=/var/log/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-rules dst=/var/lib/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-data dst=/data
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-logs dst=/var/log/suricata
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-rules dst=/var/lib/suricata
/container/add file=disk1/routeros-suricata-tzsp-arm64.tar interface=veth-ids root-dir=disk1/containers/suricata-ids-root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata-ids start-on-boot=yes logging=yes
/container/add file=routeros-suricata-tzsp-arm64.tar interface=veth-ids root-dir=/containers/suricata_0.5.3/root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata_0.5.3 start-on-boot=yes logging=yes
# Wait until /container/print shows status=stopped, then:
# /container/start suricata-ids
# /container/start suricata_0.5.3
routeros/app-template.yml
+6
View File
@@ -17,3 +17,9 @@ services:
TAP_NAME: suritap0
AUTO_BLOCK: "false"
MONITORED_NETWORKS: 192.168.100.0/24
ALERT_MAX_SEVERITY: "2"
ALERT_DEDUP_WINDOW_SECONDS: "300"
ALERT_IGNORE_SIDS: ""
ALERT_IGNORE_CATEGORIES: ""
RULE_UPDATE_INTERVAL_HOURS: "24"
ADMIN_TOKEN: ""