10. Configuration

• 10.1. Suricata.yaml
  • 10.1.1. Max-pending-packets
  • 10.1.2. Runmodes
  • 10.1.3. Default-packet-size
  • 10.1.4. User and group
  • 10.1.5. PID File
  • 10.1.6. Action-order
  • 10.1.7. Packet alert queue settings
    • 10.1.7.1. Impact on engine behavior
      • 10.1.7.1.1. Packet alert queue overflow
    • 10.1.7.2. Discarded and Suppressed Alerts Stats
  • 10.1.8. Splitting configuration in multiple files
  • 10.1.9. Event output
    • 10.1.9.1. Default logging directory
    • 10.1.9.2. Stats
    • 10.1.9.3. Outputs
    • 10.1.9.4. Line based alerts log (fast.log)
    • 10.1.9.5. Eve (Extensible Event Format)
    • 10.1.9.6. A line based log of HTTP requests (http.log)
    • 10.1.9.7. Packet log (pcap-log)
    • 10.1.9.8. Verbose Alerts Log (alert-debug.log)
    • 10.1.9.9. Alert output to prelude (alert-prelude)
    • 10.1.9.10. Stats
    • 10.1.9.11. Syslog
    • 10.1.9.12. File-store (File Extraction)
  • 10.1.10. Detection engine
    • 10.1.10.1. Inspection configuration
    • 10.1.10.2. Prefilter Engines
    • 10.1.10.3. Pattern matcher settings
  • 10.1.11. Threading
    • 10.1.11.1. Relevant cpu-affinity settings for IDS/IPS modes
    • 10.1.11.2. IDS mode
    • 10.1.11.3. IPS mode
  • 10.1.12. IP Defrag
  • 10.1.13. Flow and Stream handling
    • 10.1.13.1. Flow Settings
    • 10.1.13.2. Flow Time-Outs
    • 10.1.13.3. Stream-engine
  • 10.1.14. Application Layer Parsers
    • 10.1.14.1. Asn1_max_frames (new in 1.0.3 and 1.1)
    • 10.1.14.2. FTP
    • 10.1.14.3. Configure HTTP (libhtp)
      • 10.1.14.3.1. decompression-time-limit
    • 10.1.14.4. Configure HTTP2
    • 10.1.14.5. Configure SMB
      • 10.1.14.5.1. Resource limits
    • 10.1.14.6. SSL/TLS
      • 10.1.14.6.1. Encrypted traffic
    • 10.1.14.7. Modbus
    • 10.1.14.8. MQTT
    • 10.1.14.9. SMTP
  • 10.1.15. Engine Logging
    • 10.1.15.1. Default Configuration Example
    • 10.1.15.2. Default Log Level
    • 10.1.15.3. Default Log Format
    • 10.1.15.4. Output Filter
    • 10.1.15.5. Logging Outputs
  • 10.1.16. Packet Acquisition
    • 10.1.16.1. Pf-ring
    • 10.1.16.2. NFQ
    • 10.1.16.3. Ipfw
  • 10.1.17. Rules
    • 10.1.17.1. Rule-files
    • 10.1.17.2. Threshold-file
    • 10.1.17.3. Classifications
    • 10.1.17.4. Rule-vars
    • 10.1.17.5. Host-os-policy
  • 10.1.18. Engine analysis and profiling
    • 10.1.18.1. Engine-analysis
    • 10.1.18.2. Rule and Packet Profiling settings
    • 10.1.18.3. Packet Profiling
  • 10.1.19. Decoder
    • 10.1.19.1. Teredo
  • 10.1.20. Advanced Options
    • 10.1.20.1. stacktrace
    • 10.1.20.2. luajit
      • 10.1.20.2.1. states
• 10.2. Global-Thresholds
  • 10.2.1. Threshold Config
    • 10.2.1.1. threshold/event_filter
    • 10.2.1.2. rate_filter
      • 10.2.1.2.1. gen_id
      • 10.2.1.2.2. sig_id
      • 10.2.1.2.3. track
      • 10.2.1.2.4. count
      • 10.2.1.2.5. seconds
      • 10.2.1.2.6. new_action
      • 10.2.1.2.7. timeout
      • 10.2.1.2.8. Example
    • 10.2.1.3. suppress
  • 10.2.2. Global thresholds vs rule thresholds
    • 10.2.2.1. Suppress
    • 10.2.2.2. Threshold/event_filter
    • 10.2.2.3. Rate_filter
• 10.3. Exception Policies
  • 10.3.1. Exception Policies
  • 10.3.2. Command-line Options for Simulating Exceptions
  • 10.3.3. Common abbreviations
• 10.4. Snort.conf to Suricata.yaml
  • 10.4.1. Variables
  • 10.4.2. Decoder alerts
  • 10.4.3. Checksum handling
  • 10.4.4. Various configs
    • 10.4.4.1. Active response
    • 10.4.4.2. Dropping privileges
    • 10.4.4.3. Snaplen
    • 10.4.4.4. Bpf
  • 10.4.5. Log directory
  • 10.4.6. Packet acquisition
  • 10.4.7. Rules
• 10.5. Multi Tenancy
  • 10.5.1. Introduction
  • 10.5.2. YAML
    • 10.5.2.1. vlanid
    • 10.5.2.2. device
  • 10.5.3. Per tenant settings
  • 10.5.4. Unix Socket
    • 10.5.4.1. Registration
    • 10.5.4.2. Unix socket runmode (pcap processing)
    • 10.5.4.3. Live traffic mode
    • 10.5.4.4. Registration
• 10.6. Dropping Privileges After Startup