92 lines
2.0 KiB
YAML
92 lines
2.0 KiB
YAML
%YAML 1.1
|
|
---
|
|
# MikroSuricata IDS telemetry profile. This file is loaded after Debian's
|
|
# suricata.yaml so the output contract stays stable across package upgrades.
|
|
outputs:
|
|
# EVE already carries alerts; avoid duplicate fast.log writes.
|
|
- fast:
|
|
enabled: no
|
|
filename: fast.log
|
|
append: yes
|
|
|
|
- eve-log:
|
|
enabled: yes
|
|
filetype: regular
|
|
filename: eve.json
|
|
community-id: true
|
|
community-id-seed: 0
|
|
pcap-file: false
|
|
metadata: yes
|
|
suricata-version: yes
|
|
ethernet: yes
|
|
types:
|
|
- alert:
|
|
tagged-packets: yes
|
|
- anomaly:
|
|
enabled: yes
|
|
- http:
|
|
extended: yes
|
|
- http2
|
|
- doh2
|
|
- dns:
|
|
version: 3
|
|
enabled: yes
|
|
requests: yes
|
|
responses: yes
|
|
- mdns
|
|
- tls:
|
|
extended: yes
|
|
- files:
|
|
force-magic: no
|
|
force-hash: [sha256]
|
|
- smtp:
|
|
extended: yes
|
|
- ftp
|
|
- websocket
|
|
- rdp
|
|
- nfs
|
|
- smb
|
|
- tftp
|
|
- dcerpc
|
|
- krb5
|
|
- snmp
|
|
- rfb
|
|
- sip
|
|
- ldap
|
|
- pop3
|
|
- ssh
|
|
- arp:
|
|
enabled: yes
|
|
- quic
|
|
- dhcp:
|
|
enabled: yes
|
|
extended: yes
|
|
- ike
|
|
- mqtt
|
|
- stats:
|
|
totals: yes
|
|
threads: no
|
|
deltas: no
|
|
- flow
|
|
|
|
# Bounded forensic capture: only flows that generated an alert are kept.
|
|
# The eight 64 MB files cap disk use at roughly 512 MB inside /data/logs/suricata.
|
|
- pcap-log:
|
|
enabled: yes
|
|
filename: alert.pcap
|
|
limit: 64
|
|
max-files: 8
|
|
compression: none
|
|
mode: normal
|
|
use-stream-depth: no
|
|
honor-pass-rules: yes
|
|
conditional: alerts
|
|
|
|
# Runtime stats are already emitted inside EVE and consumed by the app.
|
|
- stats:
|
|
enabled: no
|
|
filename: stats.log
|
|
append: yes
|
|
totals: yes
|
|
threads: no
|