111 lines
3.6 KiB
Bash
111 lines
3.6 KiB
Bash
# Connection from your Linux/macOS build host to RouterOS.
|
|
ROUTER_HOST=192.168.88.1
|
|
ROUTER_USER=admin
|
|
ROUTER_PORT=22
|
|
# Optional private key. Empty means use normal ssh/scp authentication.
|
|
ROUTER_IDENTITY_FILE=
|
|
|
|
# Persistent data/log/rules storage. The versioned container root is always
|
|
# /containers/suricata_<VERSION>/root as requested.
|
|
ROUTER_DISK=disk1
|
|
# Upload directory used by upload-routeros-image.sh and generated deploy .rsc files.
|
|
ROUTER_SCP_DIR=/
|
|
|
|
CONTAINER_IP=172.31.255.2/30
|
|
CONTAINER_GATEWAY=172.31.255.1
|
|
CONTAINER_SUBNET=172.31.255.0/30
|
|
CONTAINER_BRIDGE=br-ids
|
|
CONTAINER_VETH=veth-ids
|
|
|
|
# RouterOS -> TZSP hybrid capture.
|
|
# Routed IPv4 uses /ip firewall mangle action=sniff-tzsp for high throughput.
|
|
# Packet Sniffer is kept only for non-IPv4 Ethernet frames (ARP, IPv6, LLDP,
|
|
# PPPoE discovery, etc.) using filter-mac-protocol=!ip.
|
|
TZSP_PORT=37008
|
|
CONFIGURE_TZSP_CAPTURE=true
|
|
CONFIGURE_IPV4_MANGLE=true
|
|
CONFIGURE_L2_SNIFFER=true
|
|
START_L2_SNIFFER=true
|
|
# Empty means all RouterOS interfaces. Set a real interface/bridge name only
|
|
# when you intentionally want to constrain the low-volume non-IPv4 stream.
|
|
TZSP_L2_INTERFACE=
|
|
TZSP_L2_MAC_PROTOCOL=!ip
|
|
|
|
# Rust receive-path tuning. RouterOS may cap the kernel socket buffer; the
|
|
# userspace batch queue is the primary burst buffer for high-throughput mirrors.
|
|
TZSP_RCVBUF_BYTES=33554432
|
|
TZSP_BATCH_SIZE=256
|
|
TZSP_QUEUE_MB=64
|
|
TZSP_DATAGRAM_BYTES=12288
|
|
|
|
# Suricata/app
|
|
SURICATA_HOME_NET=[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]
|
|
SURICATA_LOG_MAX_MB=512
|
|
# Forensic PCAP: alerts (default), all, off. Legacy "blocks" is accepted but
|
|
# falls back to alert capture so Python never returns to the per-packet path.
|
|
FORENSIC_PCAP_MODE=alerts
|
|
FORENSIC_PCAP_WINDOW_SECONDS=60
|
|
FORENSIC_PCAP_MEMORY_MB=64
|
|
FORENSIC_PCAP_MAX_FILES=32
|
|
FORENSIC_PCAP_MAX_TOTAL_MB=512
|
|
MONITORED_NETWORKS=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
|
|
AUTO_BLOCK=false
|
|
AUTO_BLOCK_MAX_SEVERITY=1
|
|
BLOCK_TIMEOUT=1h
|
|
UPDATE_RULES_ON_START=false
|
|
SURICATA_PERSIST_LIB_DIR=/data/lib/suricata
|
|
RULE_UPDATE_INTERVAL_HOURS=24
|
|
ALERT_RETENTION_DAYS=14
|
|
|
|
# Bounded live-traffic history. Managed Redis runs inside the same RouterOS container.
|
|
REDIS_MANAGED=true
|
|
REDIS_DATA_DIR=/data/redis
|
|
REDIS_PORT=6379
|
|
REDIS_MAXMEMORY_MB=0
|
|
REDIS_SNAPSHOT_SECONDS=1800
|
|
REDIS_AOF=true
|
|
TRAFFIC_RETENTION_HOURS=24
|
|
TRAFFIC_MAX_EVENTS=0
|
|
TRAFFIC_MEMORY_EVENTS=0
|
|
WEBSOCKET_QUEUE_SIZE=512
|
|
LIVE_FLOW_UPDATE_SECONDS=2.0
|
|
ALERT_MAX_SEVERITY=2
|
|
ALERT_DEDUP_WINDOW_SECONDS=300
|
|
# SID 1000001 is the payload-marked pipeline self-test; keep it out of production incidents.
|
|
ALERT_IGNORE_SIDS=1000001
|
|
ALERT_IGNORE_CATEGORIES=
|
|
# Dashboard login. Use a long random password. Empty ADMIN_PASSWORD keeps the UI read-only.
|
|
ADMIN_USERNAME=admin
|
|
ADMIN_PASSWORD=
|
|
# Prometheus /metrics ACL. Set the Prometheus host IP/CIDR; Basic Auth is optional.
|
|
METRICS_ALLOWED_IPS=127.0.0.1/32,::1/128
|
|
METRICS_BASIC_AUTH_USERNAME=
|
|
METRICS_BASIC_AUTH_PASSWORD=
|
|
SESSION_HOURS=168
|
|
SESSION_COOKIE_SECURE=false
|
|
ANALYTICS_SNAPSHOT_INTERVAL_SECONDS=60
|
|
|
|
# MikroSuricata NDR / correlation. Keep NDR_AUTO_BLOCK=false while baselining.
|
|
NDR_ENABLED=true
|
|
NDR_CORRELATION_WINDOW_SECONDS=1800
|
|
BEHAVIOR_MIN_OBSERVATIONS=50
|
|
NDR_AUTO_BLOCK=false
|
|
NDR_AUTO_BLOCK_RISK=92
|
|
ROUTEROS_INVENTORY_INTERVAL_SECONDS=300
|
|
|
|
# Optional high-risk incident webhook. Empty keeps telemetry local.
|
|
NOTIFY_WEBHOOK_URL=
|
|
NOTIFY_MIN_RISK=80
|
|
NOTIFY_TIMEOUT_SECONDS=5
|
|
|
|
# RouterOS REST. Not required for observation-only testing.
|
|
CREATE_REST_USER=false
|
|
ENABLE_WWW_SSL=false
|
|
ROUTEROS_REST_USER=suricata-api
|
|
ROUTEROS_REST_PASSWORD=CHANGE_ME
|
|
ROUTEROS_VERIFY_TLS=false
|
|
ROUTEROS_ADDRESS_LIST=IDS-BLOCK
|
|
|
|
# Generated deployment scripts may contain credentials and are removed by default.
|
|
KEEP_REMOTE_RSC=false
|