12. Configuration

• 12.1. Suricata.yaml
  • 12.1.1. Max-pending-packets
  • 12.1.2. Runmodes
  • 12.1.3. Default-packet-size
  • 12.1.4. User and group
  • 12.1.5. PID File
  • 12.1.6. Action-order
  • 12.1.7. Packet alert queue settings
    • 12.1.7.1. Impact on engine behavior
      • 12.1.7.1.1. Packet alert queue overflow
    • 12.1.7.2. Discarded and Suppressed Alerts Stats
  • 12.1.8. Splitting configuration in multiple files
  • 12.1.9. Event output
    • 12.1.9.1. Default logging directory
    • 12.1.9.2. Stats
    • 12.1.9.3. Outputs
    • 12.1.9.4. Line based alerts log (fast.log)
    • 12.1.9.5. Eve (Extensible Event Format)
    • 12.1.9.6. TLS parameters and certificates logging (tls.log)
    • 12.1.9.7. Packet log (pcap-log)
    • 12.1.9.8. Verbose Alerts Log (alert-debug.log)
    • 12.1.9.9. Stats
    • 12.1.9.10. Syslog
    • 12.1.9.11. File-store (File Extraction)
  • 12.1.10. Detection engine
    • 12.1.10.1. Inspection configuration
    • 12.1.10.2. Prefilter Engines
    • 12.1.10.3. Thresholding Settings
    • 12.1.10.4. Pattern matcher settings
  • 12.1.11. Threading
    • 12.1.11.1. Relevant cpu-affinity settings for IDS mode
    • 12.1.11.2. Relevant cpu-affinity settings for IPS mode
    • 12.1.11.3. Interface-specific CPU affinity settings
    • 12.1.11.4. Automatic NUMA-aware CPU core pinning
  • 12.1.12. IP Defrag
  • 12.1.13. Flow and Stream handling
    • 12.1.13.1. Flow Settings
    • 12.1.13.2. Flow Time-Outs
    • 12.1.13.3. Stream-engine
      • 12.1.13.3.1. TCP Urgent Handling
        • 12.1.13.3.1.1. Observables
  • 12.1.14. Host Tracking
    • 12.1.14.1. Settings
  • 12.1.15. Application Layer Parsers
    • 12.1.15.1. Asn1_max_frames
    • 12.1.15.2. FTP
    • 12.1.15.3. Configure HTTP (libhtp)
      • 12.1.15.3.1. decompression-time-limit
    • 12.1.15.4. Configure SMB
      • 12.1.15.4.1. Resource limits
      • 12.1.15.4.2. Cache limits
    • 12.1.15.5. Configure NFS
      • 12.1.15.5.1. Resource limits
    • 12.1.15.6. Configure DCERPC
    • 12.1.15.7. Configure HTTP2
    • 12.1.15.8. SSL/TLS
      • 12.1.15.8.1. Encrypted traffic
    • 12.1.15.9. SSH
    • 12.1.15.10. Modbus
    • 12.1.15.11. MQTT
    • 12.1.15.12. RFB
    • 12.1.15.13. SMTP
    • 12.1.15.14. Maximum transactions
    • 12.1.15.15. Maximum Responses
  • 12.1.16. Engine Logging
    • 12.1.16.1. Default Configuration Example
    • 12.1.16.2. Default Log Level
    • 12.1.16.3. Default Log Format
    • 12.1.16.4. Output Filter
    • 12.1.16.5. Logging Outputs
  • 12.1.17. Packet Acquisition
    • 12.1.17.1. Data Plane Development Kit (DPDK)
    • 12.1.17.2. Pf-ring
    • 12.1.17.3. NFQ
    • 12.1.17.4. Ipfw
  • 12.1.18. Rules
    • 12.1.18.1. Rule Files
    • 12.1.18.2. Threshold-file
    • 12.1.18.3. Classifications
    • 12.1.18.4. Rule-vars
    • 12.1.18.5. Host-os-policy
  • 12.1.19. Suricata as a Firewall options (experimental)
  • 12.1.20. Engine analysis and profiling
    • 12.1.20.1. Engine-analysis
    • 12.1.20.2. Rule and Packet Profiling settings
    • 12.1.20.3. Packet Profiling
  • 12.1.21. Decoder
    • 12.1.21.1. Teredo
    • 12.1.21.2. VXLAN
    • 12.1.21.3. Recursion Level
  • 12.1.22. Advanced Options
    • 12.1.22.1. stacktrace
  • 12.1.23. Configuration hardening
    • 12.1.23.1. Lua
• 12.2. Global-Thresholds
  • 12.2.1. Threshold Config
    • 12.2.1.1. threshold/event_filter
    • 12.2.1.2. rate_filter
      • 12.2.1.2.1. gen_id
      • 12.2.1.2.2. sig_id
      • 12.2.1.2.3. track
      • 12.2.1.2.4. count
      • 12.2.1.2.5. seconds
      • 12.2.1.2.6. new_action
      • 12.2.1.2.7. timeout
      • 12.2.1.2.8. Example
    • 12.2.1.3. suppress
  • 12.2.2. Global thresholds vs rule thresholds
    • 12.2.2.1. Suppress
    • 12.2.2.2. Threshold/event_filter
    • 12.2.2.3. Rate_filter
• 12.3. Exception Policies
  • 12.3.1. Master Switch
    • 12.3.1.1. Auto
  • 12.3.2. Specific settings
  • 12.3.3. Exception Policies and Midstream Pick-up Sessions
    • 12.3.3.1. Exception Policies Interactions
  • 12.3.4. Log Output
    • 12.3.4.1. Flow Event
    • 12.3.4.2. Available Stats
  • 12.3.5. Command-line Options for Simulating Exceptions
  • 12.3.6. Glossary
    • 12.3.6.1. Common abbreviations
• 12.4. Snort.conf to Suricata.yaml
  • 12.4.1. Variables
  • 12.4.2. Decoder alerts
  • 12.4.3. Checksum handling
  • 12.4.4. Various configs
    • 12.4.4.1. Active response
    • 12.4.4.2. Dropping privileges
    • 12.4.4.3. Snaplen
    • 12.4.4.4. Bpf
  • 12.4.5. Log directory
  • 12.4.6. Packet acquisition
  • 12.4.7. Rules
• 12.5. Multi Tenancy
  • 12.5.1. Introduction
  • 12.5.2. YAML
    • 12.5.2.1. vlan-id
    • 12.5.2.2. device
  • 12.5.3. Per tenant settings
  • 12.5.4. Unix Socket
    • 12.5.4.1. Registration
    • 12.5.4.2. Unix socket runmode (pcap processing)
    • 12.5.4.3. Live traffic mode
    • 12.5.4.4. Registration
    • 12.5.4.5. Reloads
  • 12.5.5. Eve JSON output
• 12.6. Dropping Privileges After Startup
• 12.7. Using Landlock LSM
• 12.8. systemd notification
  • 12.8.1. Introduction
  • 12.8.2. Example
  • 12.8.3. Requirements
  • 12.8.4. Additional Information
• 12.9. Includes
  • 12.9.1. Including a Single File
  • 12.9.2. Including Multiple Files
  • 12.9.3. Include Inside a Mapping