33 lines
773 B
Bash
33 lines
773 B
Bash
# Capture
|
|
TZSP_BIND=0.0.0.0
|
|
TZSP_PORT=37008
|
|
TAP_NAME=suritap0
|
|
TAP_MTU=9000
|
|
|
|
# Suricata
|
|
SURICATA_CONFIG=/etc/suricata/suricata.yaml
|
|
SURICATA_HOME_NET=[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]
|
|
UPDATE_RULES_ON_START=false
|
|
|
|
# App / dashboard
|
|
WEB_BIND=0.0.0.0
|
|
WEB_PORT=8080
|
|
DB_PATH=/data/ids.db
|
|
EVE_PATH=/var/log/suricata/eve.json
|
|
ALERT_RETENTION_DAYS=14
|
|
|
|
# Policy. Keep AUTO_BLOCK=false until observation mode is validated.
|
|
AUTO_BLOCK=false
|
|
AUTO_BLOCK_MAX_SEVERITY=1
|
|
MONITORED_NETWORKS=192.168.100.0/24
|
|
NEVER_BLOCK=1.1.1.1/32,8.8.8.8/32
|
|
BLOCK_TIMEOUT=1h
|
|
|
|
# RouterOS REST - only needed when AUTO_BLOCK=true
|
|
ROUTEROS_URL=https://172.31.255.1
|
|
ROUTEROS_USER=suricata-api
|
|
ROUTEROS_PASSWORD=CHANGE_ME
|
|
ROUTEROS_VERIFY_TLS=false
|
|
ROUTEROS_ADDRESS_LIST=IDS-BLOCK
|
|
ROUTEROS_HTTP_TIMEOUT=5
|