%YAML 1.1
---
# MikroSuricata IDS telemetry profile. This file is loaded after Debian's
# suricata.yaml so the output contract stays stable across package upgrades.
outputs:
  # EVE already carries alerts; avoid duplicate fast.log writes.
  - fast:
      enabled: no
      filename: fast.log
      append: yes

  - eve-log:
      enabled: yes
      filetype: regular
      filename: eve.json
      community-id: true
      community-id-seed: 0
      pcap-file: false
      metadata: yes
      suricata-version: yes
      ethernet: yes
      types:
        - alert:
            tagged-packets: yes
        - anomaly:
            enabled: yes
        - http:
            extended: yes
        - http2
        - doh2
        - dns:
            version: 3
            enabled: yes
            requests: yes
            responses: yes
        - mdns
        - tls:
            extended: yes
        - files:
            force-magic: no
            force-hash: [sha256]
        - smtp:
            extended: yes
        - ftp
        - websocket
        - rdp
        - nfs
        - smb
        - tftp
        - dcerpc
        - krb5
        - snmp
        - rfb
        - sip
        - ldap
        - pop3
        - ssh
        - arp:
            enabled: yes
        - quic
        - dhcp:
            enabled: yes
            extended: yes
        - ike
        - mqtt
        - stats:
            totals: yes
            threads: no
            deltas: no
        - flow

  # Bounded forensic capture: only flows that generated an alert are kept.
  # The eight 64 MB files cap disk use at roughly 512 MB inside /data/logs/suricata.
  - pcap-log:
      enabled: yes
      filename: alert.pcap
      limit: 64
      max-files: 8
      compression: none
      mode: normal
      use-stream-depth: no
      honor-pass-rules: yes
      conditional: alerts

  # Runtime stats are already emitted inside EVE and consumed by the app.
  - stats:
      enabled: no
      filename: stats.log
      append: yes
      totals: yes
      threads: no