worked poc

suricata/custom.rules.default

@@ -0,0 +1,9 @@
+# Environment-specific local signatures live here after first startup.
+# This file is copied to /data/suricata/custom.rules and is not overwritten.
+#
+# Built-in production rules use SIDs 1000101-1000108. Reserve 1000001 for the
+# pipeline self-test. Use 1001000+ for your own site-specific signatures to
+# avoid accidental collisions with the image baseline.
+#
+# Example (disabled/commented):
+# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"LOCAL SITE suspicious URI marker"; flow:established,to_server; http.uri; content:"/admin/export"; nocase; classtype:web-application-activity; priority:2; sid:1001000; rev:1;)

suricata/disable.conf

@@ -0,0 +1,4 @@
+# suricata-update disable filters. Add specific noisy SIDs here and run
+# scripts/update-rules.sh. Avoid disabling broad rule groups until you have
+# observed your own traffic profile.
+# 1234567

suricata/enable.conf

@@ -0,0 +1 @@
+# suricata-update enable filters.

suricata/local.rules

@@ -1,2 +1,38 @@
-# Local deterministic pipeline test. send_test_tzsp.py emits ICMP echo requests.
-alert icmp any any -> any any (msg:"LOCAL TZSP PIPELINE TEST"; itype:8; classtype:bad-unknown; sid:1000001; rev:1;)
+# RouterOS Suricata TZSP - built-in rules.
+#
+# SID 1000001 is reserved for the deterministic pipeline self-test. It only
+# matches the marker emitted by scripts/send_test_tzsp.py, so normal ICMP/ping
+# traffic cannot trigger it. The application also ignores this SID in the
+# incident database by default.
+alert icmp any any -> any any (msg:"LOCAL TEST TZSP PIPELINE MARKER"; itype:8; content:"routeros-suricata-tzsp-selftest"; nocase; classtype:misc-activity; priority:3; sid:1000001; rev:3;)
+
+# Conservative production baseline. ET/Open is baked into the image as the
+# vendor ruleset; these local rules add a few rate-based detections that are
+# useful on a mirrored RouterOS edge without alerting on single packets.
+
+# Repeated external SSH connection attempts against HOME_NET.
+alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"LOCAL PROD repeated SSH connection attempts"; flags:S; flow:stateless; threshold: type both, track by_src, count 10, seconds 60; classtype:attempted-admin; priority:1; sid:1000101; rev:1;)
+
+# Repeated external RDP connection attempts against HOME_NET.
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"LOCAL PROD repeated RDP connection attempts"; flags:S; flow:stateless; threshold: type both, track by_src, count 8, seconds 60; classtype:attempted-admin; priority:1; sid:1000102; rev:1;)
+
+# Repeated access attempts to RouterOS WinBox from outside HOME_NET.
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8291 (msg:"LOCAL PROD repeated RouterOS WinBox connection attempts"; flags:S; flow:stateless; threshold: type both, track by_src, count 8, seconds 60; classtype:attempted-admin; priority:1; sid:1000103; rev:1;)
+
+# High-rate SYN activity against HOME_NET. The threshold intentionally requires
+# a burst to avoid treating ordinary connection setup as a scan.
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"LOCAL PROD possible TCP SYN scan"; flags:S; flow:stateless; threshold: type both, track by_src, count 40, seconds 10; classtype:attempted-recon; priority:2; sid:1000104; rev:1;)
+
+# High-rate ICMP echo requests from one external source.
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"LOCAL PROD possible ICMP sweep"; itype:8; threshold: type both, track by_src, count 20, seconds 10; classtype:attempted-recon; priority:2; sid:1000105; rev:1;)
+
+# Direct inbound SMB from outside HOME_NET. Rate-limited because some networks
+# intentionally expose SMB over controlled tunnels or provider networks.
+alert tcp $EXTERNAL_NET any -> $HOME_NET [139,445] (msg:"LOCAL PROD inbound SMB from external network"; flags:S; flow:stateless; threshold: type limit, track by_src, count 1, seconds 300; classtype:policy-violation; priority:2; sid:1000106; rev:1;)
+
+# Very long first DNS labels can be a tunnelling/exfiltration signal. A single
+# source can create at most one alert every five minutes for this local rule.
+alert dns $HOME_NET any -> any 53 (msg:"LOCAL PROD unusually long DNS query label"; dns.query; pcre:"/^[A-Za-z0-9_-]{48,}\./"; threshold: type limit, track by_src, count 1, seconds 300; classtype:bad-unknown; priority:2; sid:1000107; rev:1;)
+
+# Cleartext Telnet leaving HOME_NET. One alert per source every ten minutes.
+alert tcp $HOME_NET any -> $EXTERNAL_NET 23 (msg:"LOCAL PROD outbound Telnet session"; flow:established,to_server; threshold: type limit, track by_src, count 1, seconds 600; classtype:policy-violation; priority:2; sid:1000108; rev:1;)

suricata/modify.conf

@@ -0,0 +1,3 @@
+# suricata-update rule modifications.
+# Example:
+# 1234567 "seconds \\d+" "seconds 300"

suricata/threshold.config

@@ -0,0 +1,12 @@
+# Managed Suricata threshold/suppression configuration.
+#
+# Keep this file environment-specific. Examples:
+#
+# Suppress one known false-positive SID completely:
+# suppress gen_id 1, sig_id 1234567
+#
+# Suppress a SID only for a trusted host/network:
+# suppress gen_id 1, sig_id 1234567, track by_src, ip 192.168.100.10
+#
+# Limit a noisy SID to one alert per source every 5 minutes:
+# threshold gen_id 1, sig_id 1234567, type limit, track by_src, count 1, seconds 300