%YAML 1.1

---

# Suricata configuration file. In addition to the comments describing all

# options in this file, full documentation can be found at:

# https://docs.suricata.io/en/latest/configuration/suricata-yaml.html

# This configuration file was generated by Suricata @PACKAGE_VERSION@.

suricata-version: "@MAJOR_MINOR@"

##

## Step 1: Inform Suricata about your network

##

vars:

# more specific is better for alert accuracy and performance

address-groups:

HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"

#HOME_NET: "[192.168.0.0/16]"

#HOME_NET: "[10.0.0.0/8]"

#HOME_NET: "[172.16.0.0/12]"

#HOME_NET: "any"

EXTERNAL_NET: "!$HOME_NET"

#EXTERNAL_NET: "any"

HTTP_SERVERS: "$HOME_NET"

SMTP_SERVERS: "$HOME_NET"

SQL_SERVERS: "$HOME_NET"

DNS_SERVERS: "$HOME_NET"

TELNET_SERVERS: "$HOME_NET"

AIM_SERVERS: "$EXTERNAL_NET"

DC_SERVERS: "$HOME_NET"

DNP3_SERVER: "$HOME_NET"

DNP3_CLIENT: "$HOME_NET"

MODBUS_CLIENT: "$HOME_NET"

MODBUS_SERVER: "$HOME_NET"

ENIP_CLIENT: "$HOME_NET"

ENIP_SERVER: "$HOME_NET"

port-groups:

HTTP_PORTS: "80"

SHELLCODE_PORTS: "!80"

ORACLE_PORTS: 1521

SSH_PORTS: 22

DNP3_PORTS: 20000

MODBUS_PORTS: 502

FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"

FTP_PORTS: 21

GENEVE_PORTS: 6081

VXLAN_PORTS: 4789

TEREDO_PORTS: 3544

SIP_PORTS: "[5060, 5061]"

##

## Step 2: Select outputs to enable

##

# The default logging directory. Any log or output file will be

# placed here if it's not specified with a full path name. This can be

# overridden with the -l command line parameter.

default-log-dir: @e_logdir@

# Global stats configuration

stats:

enabled: yes

# The interval field (in seconds) controls the interval at

# which stats are updated in the log.

interval: 8

# Add decode events to stats.

#decoder-events: true

# Decoder event prefix in stats. Has been 'decoder' before, but that leads

# to missing events in the eve.stats records. See issue #2225.

#decoder-events-prefix: "decoder.event"

# Add stream events as stats.

#stream-events: false

exception-policy:

#per-app-proto-errors: false # default: false. True will log errors for

# each app-proto. Warning: VERY verbose

# Plugins -- Experimental -- specify the filename for each plugin shared object

plugins:

# - /path/to/plugin.so

# Configure the type of alert (and other) logging you would like.

outputs:

# a line based alerts log similar to Snort's fast.log

- fast:

enabled: yes

filename: fast.log

append: yes

#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'

# Extensible Event Format (nicknamed EVE) event log in JSON format

- eve-log:

enabled: @e_enable_evelog@

filetype: regular #regular|syslog|unix_dgram|unix_stream|redis

filename: eve.json

# Enable for multi-threaded eve.json output; output files are amended with

# an identifier, e.g., eve.9.json

#threaded: false

#prefix: "@cee: " # prefix to prepend to each log entry

# the following are valid when type: syslog above

#identity: "suricata"

#facility: local5

#level: Info ## possible levels: Emergency, Alert, Critical,

## Error, Warning, Notice, Info, Debug

#ethernet: no # log ethernet header in events when available

#redis:

# server: 127.0.0.1

# port: 6379

# async: true ## if redis replies are read asynchronously

# mode: list ## possible values: list|lpush (default), rpush, channel|publish

# ## lpush and rpush are using a Redis list. "list" is an alias for lpush

# ## publish is using a Redis channel. "channel" is an alias for publish

# key: suricata ## key or channel to use (default to suricata)

# Redis pipelining set up. This will enable to only do a query every

# 'batch-size' events. This should lower the latency induced by network

# connection at the cost of some memory. There is no flushing implemented

# so this setting should be reserved to high traffic Suricata deployments.

# pipelining:

# enabled: yes ## set enable to yes to enable query pipelining

# batch-size: 10 ## number of entries to keep in buffer

# Include top level metadata. Default yes.

#metadata: no

# include the name of the input pcap file in pcap file processing mode

pcap-file: false

# Community Flow ID

# Adds a 'community_id' field to EVE records. These are meant to give

# records a predictable flow ID that can be used to match records to

# output of other tools such as Zeek (Bro).

#

# Takes a 'seed' that needs to be same across sensors and tools

# to make the id less predictable.

# enable/disable the community id feature.

community-id: false

# Seed value for the ID output. Valid values are 0-65535.

community-id-seed: 0

# HTTP X-Forwarded-For support by adding an extra field or overwriting

# the source or destination IP address (depending on flow direction)

# with the one reported in the X-Forwarded-For HTTP header. This is

# helpful when reviewing alerts for traffic that is being reverse

# or forward proxied.

xff:

enabled: no

# Two operation modes are available: "extra-data" and "overwrite".

mode: extra-data

# Two proxy deployments are supported: "reverse" and "forward". In

# a "reverse" deployment the IP address used is the last one, in a

# "forward" deployment the first IP address is used.

deployment: reverse

# Header name where the actual IP address will be reported. If more

# than one IP address is present, the last IP address will be the

# one taken into consideration.

header: X-Forwarded-For

types:

- alert:

# payload: yes # enable dumping payload in Base64

# payload-buffer-size: 4kb # max size of payload buffer to output in eve-log

# payload-printable: yes # enable dumping payload in printable (lossy) format

# packet: yes # enable dumping of packet (without stream segments)

# metadata: no # enable inclusion of app layer metadata with alert. Default yes

# http-body: yes # Requires metadata; enable dumping of HTTP body in Base64

# http-body-printable: yes # Requires metadata; enable dumping of HTTP body in printable format

# websocket-payload: yes # Requires metadata; enable dumping of WebSocket Payload in Base64

# websocket-payload-printable: yes # Requires metadata; enable dumping of WebSocket Payload in printable format

# Enable the logging of tagged packets for rules using the

# "tag" keyword.

tagged-packets: yes

# Enable logging the final action taken on a packet by the engine

# (e.g: the alert may have action 'allowed' but the verdict be

# 'drop' due to another alert. That's the engine's verdict)

# verdict: yes

# app layer frames

- frame:

# disabled by default as this is very verbose.

enabled: no

# payload-buffer-size: 4kb # max size of frame payload buffer to output in eve-log

- anomaly:

# Anomaly log records describe unexpected conditions such

# as truncated packets, packets with invalid IP/UDP/TCP

# length values, and other events that render the packet

# invalid for further processing or describe unexpected

# behavior on an established stream. Networks which

# experience high occurrences of anomalies may experience

# packet processing degradation.

#

# Anomalies are reported for the following:

# 1. Decode: Values and conditions that are detected while

# decoding individual packets. This includes invalid or

# unexpected values for low-level protocol lengths as well

# as stream related events (TCP 3-way handshake issues,

# unexpected sequence number, etc).

# 2. Stream: This includes stream related events (TCP

# 3-way handshake issues, unexpected sequence number,

# etc).

# 3. Application layer: These denote application layer

# specific conditions that are unexpected, invalid or are

# unexpected given the application monitoring state.

#

# By default, anomaly logging is enabled. When anomaly

# logging is enabled, applayer anomaly reporting is

# also enabled.

enabled: yes

#

# Choose one or more types of anomaly logging and whether to enable

# logging of the packet header for packet anomalies.

types:

# decode: no

# stream: no

# applayer: yes

#packethdr: no

- http:

extended: yes # enable this for extended logging information

# custom allows additional HTTP fields to be included in eve-log.

# the example below adds three additional fields when uncommented

#custom: [Accept-Encoding, Accept-Language, Authorization]

# set this value to one and only one from {both, request, response}

# to dump all HTTP headers for every HTTP request and/or response

# dump-all-headers: none

- dns:

# This configuration uses the new DNS logging format,

# the old configuration is still available:

# https://docs.suricata.io/en/latest/output/eve/eve-json-output.html#dns-v1-format

# As of Suricata 5.0, version 2 of the eve dns output

# format is the default.

#version: 2

# Enable/disable this logger. Default: enabled.

#enabled: yes

# Control logging of requests and responses:

# - requests: enable logging of DNS queries

# - responses: enable logging of DNS answers

# By default both requests and responses are logged.

#requests: no

#responses: no

# Format of answer logging:

# - detailed: array item per answer

# - grouped: answers aggregated by type

# Default: all

#formats: [detailed, grouped]

# DNS record types to log, based on the query type.

# Default: all.

#types: [a, aaaa, cname, mx, ns, ptr, txt]

- tls:

extended: yes # enable this for extended logging information

# output TLS transaction where the session is resumed using a

# session id

#session-resumption: no

# custom controls which TLS fields that are included in eve-log

#custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3, ja3s, ja4, subjectaltname]

- files:

force-magic: no # force logging magic on all logged files

# force logging of checksums, available hash functions are md5,

# sha1 and sha256

#force-hash: [md5]

#- drop:

# alerts: yes # log alerts that caused drops

# flows: all # start or all: 'start' logs only a single drop

# # per flow direction. All logs each dropped pkt.

# Enable logging the final action taken on a packet by the engine

# (will show more information in case of a drop caused by 'reject')

# verdict: yes

- smtp:

#extended: yes # enable this for extended logging information

# this includes: bcc, message-id, subject, x_mailer, user-agent

# custom fields logging from the list:

# reply-to, bcc, message-id, subject, x-mailer, user-agent, received,

# x-originating-ip, in-reply-to, references, importance, priority,

# sensitivity, organization, content-md5, date

#custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]

# output md5 of fields: body, subject

# for the body you need to set app-layer.protocols.smtp.mime.body-md5

# to yes

#md5: [body, subject]

#- dnp3

- websocket

- ftp

- rdp

- nfs

- smb

- tftp

- ike

- dcerpc

- krb5

- bittorrent-dht

- snmp

- rfb

- sip

- quic

- arp:

enabled: no # Many events can be logged. Disabled by default

- dhcp:

enabled: yes

# When extended mode is on, all DHCP messages are logged

# with full detail. When extended mode is off (the

# default), just enough information to map a MAC address

# to an IP address is logged.

extended: no

- ssh

- mqtt:

# passwords: yes # enable output of passwords

- http2

- pgsql:

enabled: no

# passwords: yes # enable output of passwords. Disabled by default

- stats:

totals: yes # stats for all threads merged together

threads: no # per thread stats

deltas: no # include delta values

# Don't log stats counters that are zero. Default: true

#null-values: false # False will NOT log stats counters: 0

# bi-directional flows

- flow

# uni-directional flows

#- netflow

# Metadata event type. Triggered whenever a pktvar is saved

# and will include the pktvars, flowvars, flowbits and

# flowints.

#- metadata

# EXPERIMENTAL per packet output giving TCP state tracking details

# including internal state, flags, etc.

# This output is experimental, meant for debugging and subject to

# change in both config and output without any notice.

#- stream:

# all: false # log all TCP packets

# event-set: false # log packets that have a decoder/stream event

# state-update: false # log packets triggering a TCP state update

# spurious-retransmission: false # log spurious retransmission packets

# a line based log of HTTP requests (no alerts)

- http-log:

enabled: no

filename: http.log

append: yes

#extended: yes # enable this for extended logging information

#custom: yes # enable the custom logging format (defined by customformat)

#customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %H %m %h %u %s %B %a:%p -> %A:%P"

#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'

# a line based log of TLS handshake parameters (no alerts)

- tls-log:

enabled: no # Log TLS connections.

filename: tls.log # File to store TLS logs.

append: yes

#extended: yes # Log extended information like fingerprint

#custom: yes # enabled the custom logging format (defined by customformat)

#customformat: "%{%D-%H:%M:%S}t.%z %a:%p -> %A:%P %v %n %d %D"

#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'

# output TLS transaction where the session is resumed using a

# session id

#session-resumption: no

# output module to store certificates chain to disk

- tls-store:

enabled: no

#certs-log-dir: certs # directory to store the certificates files

# Packet log... log packets in pcap format. 2 modes of operation: "normal"

# and "multi".

#

# In normal mode a pcap file "filename" is created in the default-log-dir,

# or as specified by "dir".

# In multi mode, a file is created per thread. This will perform much

# better, but will create multiple files where 'normal' would create one.

# In multi mode the filename takes a few special variables:

# - %n -- thread number

# - %i -- thread id

# - %t -- timestamp (secs or secs.usecs based on 'ts-format'

# E.g. filename: pcap.%n.%t

#

# Note that it's possible to use directories, but the directories are not

# created by Suricata. E.g. filename: pcaps/%n/log.%s will log into the

# per thread directory.

#

# Also note that the limit and max-files settings are enforced per thread.

# So the size limit when using 8 threads with 1000mb files and 2000 files

# is: 8*1000*2000 ~ 16TiB.

#

# By default all packets are logged except:

# - TCP streams beyond stream.reassembly.depth

# - encrypted streams after the key exchange

#

- pcap-log:

enabled: no

filename: log.pcap

# File size limit. Can be specified in kb, mb, gb. Just a number

# is parsed as bytes.

limit: 1000mb

# If set to a value, ring buffer mode is enabled. Will keep maximum of

# "max-files" of size "limit"

max-files: 2000

# Compression algorithm for pcap files. Possible values: none, lz4.

# Note also that on Windows, enabling compression will *increase* disk I/O.

compression: none

# Further options for lz4 compression. The compression level can be set

# to a value between 0 and 16, where higher values result in higher

# compression.

#lz4-checksum: no

#lz4-level: 0

mode: normal # normal or multi

# Directory to place pcap files. If not provided the default log

# directory will be used.

#dir: /nsm_data/

#ts-format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec

use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets

honor-pass-rules: no # If set to "yes", flows in which a pass rule matched will stop being logged.

# Use "all" to log all packets or use "alerts" to log only alerted packets and flows or "tag"

# to log only flow tagged via the "tag" keyword

#conditional: all

# a full alert log containing much information for signature writers

# or for investigating suspected false positives.

- alert-debug:

enabled: no

filename: alert-debug.log

append: yes

#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'

# Stats.log contains data from various counters of the Suricata engine.

- stats:

enabled: yes

filename: stats.log

append: yes # append to file (yes) or overwrite it (no)

totals: yes # stats for all threads merged together

threads: no # per thread stats

#null-values: yes # print counters that have value 0. Default: no

# a line based alerts log similar to fast.log into syslog

- syslog:

enabled: no

# reported identity to syslog. If omitted the program name (usually

# suricata) will be used.

#identity: "suricata"

facility: local5

#level: Info ## possible levels: Emergency, Alert, Critical,

## Error, Warning, Notice, Info, Debug

# Output module for storing files on disk. Files are stored in

# directory names consisting of the first 2 characters of the

# SHA256 of the file. Each file is given its SHA256 as a filename.

#

# When a duplicate file is found, the timestamps on the existing file

# are updated.

#

# Unlike the older filestore, metadata is not written by default

# as each file should already have a "fileinfo" record in the

# eve-log. If write-fileinfo is set to yes, then each file will have

# one more associated .json files that consist of the fileinfo

# record. A fileinfo file will be written for each occurrence of the

# file seen using a filename suffix to ensure uniqueness.

#

# To prune the filestore directory see the "suricatactl filestore

# prune" command which can delete files over a certain age.

- file-store:

version: 2

enabled: no

# Set the directory for the filestore. Relative pathnames

# are contained within the "default-log-dir".

#dir: filestore

# Write out a fileinfo record for each occurrence of a file.

# Disabled by default as each occurrence is already logged

# as a fileinfo record to the main eve-log.

#write-fileinfo: yes

# Force storing of all files. Default: no.

#force-filestore: yes

# Override the global stream-depth for sessions in which we want

# to perform file extraction. Set to 0 for unlimited; otherwise,

# must be greater than the global stream-depth value to be used.

#stream-depth: 0

# Uncomment the following variable to define how many files can

# remain open for filestore by Suricata. Default value is 0 which

# means files get closed after each write to the file.

#max-open-files: 1000

# Force logging of checksums: available hash functions are md5,

# sha1 and sha256. Note that SHA256 is automatically forced by

# the use of this output module as it uses the SHA256 as the

# file naming scheme.

#force-hash: [sha1, md5]

# NOTE: X-Forwarded configuration is ignored if write-fileinfo is disabled

# HTTP X-Forwarded-For support by adding an extra field or overwriting

# the source or destination IP address (depending on flow direction)

# with the one reported in the X-Forwarded-For HTTP header. This is

# helpful when reviewing alerts for traffic that is being reverse

# or forward proxied.

xff:

enabled: no

# Two operation modes are available, "extra-data" and "overwrite".

mode: extra-data

# Two proxy deployments are supported, "reverse" and "forward". In

# a "reverse" deployment the IP address used is the last one, in a

# "forward" deployment the first IP address is used.

deployment: reverse

# Header name where the actual IP address will be reported. If more

# than one IP address is present, the last IP address will be the

# one taken into consideration.

header: X-Forwarded-For

# Log TCP data after stream normalization

# Two types: file or dir:

# - file logs into a single logfile.

# - dir creates 2 files per TCP session and stores the raw TCP

# data into them.

# Use 'both' to enable both file and dir modes.

#

# Note: limited by "stream.reassembly.depth"

- tcp-data:

enabled: no

type: file

filename: tcp-data.log

# Log HTTP body data after normalization, de-chunking and unzipping.

# Two types: file or dir.

# - file logs into a single logfile.

# - dir creates 2 files per HTTP session and stores the

# normalized data into them.

# Use 'both' to enable both file and dir modes.

#

# Note: limited by the body limit settings

- http-body-data:

enabled: no

type: file

filename: http-data.log

# Lua Output Support - execute lua script to generate alert and event

# output.

# Documented at:

# https://docs.suricata.io/en/latest/output/lua-output.html

- lua:

enabled: no

#scripts-dir: /etc/suricata/lua-output/

scripts:

# - script1.lua

# Logging configuration. This is not about logging IDS alerts/events, but

# output about what Suricata is doing, like startup messages, errors, etc.

logging:

# The default log level: can be overridden in an output section.

# Note that debug level logging will only be emitted if Suricata was

# compiled with the --enable-debug configure option.

#

# This value is overridden by the SC_LOG_LEVEL env var.

default-log-level: notice

# The default output format. Optional parameter, should default to

# something reasonable if not provided. Can be overridden in an

# output section. You can leave this out to get the default.

#

# This console log format value can be overridden by the SC_LOG_FORMAT env var.

#default-log-format: "%D: %S: %M"

#

# For the pre-7.0 log format use:

#default-log-format: "[%i] %t [%S] - (%f:%l) <%d> (%n) -- "

# A regex to filter output. Can be overridden in an output section.

# Defaults to empty (no filter).

#

# This value is overridden by the SC_LOG_OP_FILTER env var.

default-output-filter:

# Requires libunwind to be available when Suricata is configured and built.

# If a signal unexpectedly terminates Suricata, displays a brief diagnostic

# message with the offending stacktrace if enabled.

#stacktrace-on-signal: on

# Define your logging outputs. If none are defined, or they are all

# disabled you will get the default: console output.

outputs:

- console:

enabled: yes

# type: json

- file:

enabled: yes

level: info

filename: suricata.log

# format: "[%i - %m] %z %d: %S: %M"

# type: json

- syslog:

enabled: no

facility: local5

format: "[%i] <%d> -- "

# type: json

##

## Step 3: Configure common capture settings

##

## See "Advanced Capture Options" below for more options, including Netmap

## and PF_RING.

##

# Linux high speed capture support

af-packet:

- interface: eth0

# Number of receive threads. "auto" uses the number of cores

#threads: auto

# Default clusterid. AF_PACKET will load balance packets based on flow.

cluster-id: 99

# Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.

# This is only supported for Linux kernel > 3.1

# possible value are:

# * cluster_flow: all packets of a given flow are sent to the same socket

# * cluster_cpu: all packets treated in kernel by a CPU are sent to the same socket

# * cluster_qm: all packets linked by network card to a RSS queue are sent to the same

# socket. Requires at least Linux 3.14.

# * cluster_ebpf: eBPF file load balancing. See doc/userguide/capture-hardware/ebpf-xdp.rst for

# more info.

# Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system

# with capture card using RSS (requires cpu affinity tuning and system IRQ tuning)

# cluster_rollover has been deprecated; if used, it'll be replaced with cluster_flow.

cluster-type: cluster_flow

# In some fragmentation cases, the hash can not be computed. If "defrag" is set

# to yes, the kernel will do the needed defragmentation before sending the packets.

defrag: yes

# To use the ring feature of AF_PACKET, set 'use-mmap' to yes

#use-mmap: yes

# Lock memory map to avoid it being swapped. Be careful that over

# subscribing could lock your system

#mmap-locked: yes

# Use tpacket_v3 capture mode, only active if use-mmap is true

# Don't use it in IPS or TAP mode as it causes severe latency

#tpacket-v3: yes

# Ring size will be computed with respect to "max-pending-packets" and number

# of threads. You can set manually the ring size in number of packets by setting

# the following value. If you are using flow "cluster-type" and have really network

# intensive single-flow you may want to set the "ring-size" independently of the number

# of threads:

#ring-size: 2048

# Block size is used by tpacket_v3 only. It should set to a value high enough to contain

# a decent number of packets. Size is in bytes so please consider your MTU. It should be

# a power of 2 and it must be multiple of page size (usually 4096).

#block-size: 32768

# tpacket_v3 block timeout: an open block is passed to userspace if it is not

# filled after block-timeout milliseconds.

#block-timeout: 10

# On busy systems, set it to yes to help recover from a packet drop

# phase. This will result in some packets (at max a ring flush) not being inspected.

#use-emergency-flush: yes

# recv buffer size, increased value could improve performance

# buffer-size: 32768

# Set to yes to disable promiscuous mode

# disable-promisc: no

# Choose checksum verification mode for the interface. At the moment

# of the capture, some packets may have an invalid checksum due to

# the checksum computation being offloaded to the network card.

# Possible values are:

# - kernel: use indication sent by kernel for each packet (default)

# - yes: checksum validation is forced

# - no: checksum validation is disabled

# - auto: Suricata uses a statistical approach to detect when

# checksum off-loading is used.

# Warning: 'capture.checksum-validation' must be set to yes to have any validation

#checksum-checks: kernel

# BPF filter to apply to this interface. The pcap filter syntax applies here.

#bpf-filter: port 80 or udp

# You can use the following variables to activate AF_PACKET tap or IPS mode.

# If copy-mode is set to ips or tap, the traffic coming to the current

# interface will be copied to the copy-iface interface. If 'tap' is set, the

# copy is complete. If 'ips' is set, the packet matching a 'drop' action

# will not be copied.

#copy-mode: ips

#copy-iface: eth1

# For eBPF and XDP setup including bypass, filter and load balancing, please

# see doc/userguide/capture-hardware/ebpf-xdp.rst for more info.

# Put default values here. These will be used for an interface that is not

# in the list above.

- interface: default

#threads: auto

#use-mmap: no

#tpacket-v3: yes

# Linux high speed af-xdp capture support

af-xdp:

- interface: default

# Number of receive threads. "auto" uses least between the number

# of cores and RX queues

#threads: auto

#disable-promisc: false

# XDP_DRV mode can be chosen when the driver supports XDP

# XDP_SKB mode can be chosen when the driver does not support XDP

# Possible values are:

# - drv: enable XDP_DRV mode

# - skb: enable XDP_SKB mode

# - none: disable (kernel in charge of applying mode)

#force-xdp-mode: none

# During socket binding the kernel will attempt zero-copy, if this

# fails it will fallback to copy. If this fails, the bind fails.

# The bind can be explicitly configured using the option below.

# If configured, the bind will fail if not successful (no fallback).

# Possible values are:

# - zero: enable zero-copy mode

# - copy: enable copy mode

# - none: disable (kernel in charge of applying mode)

#force-bind-mode: none

# Memory alignment mode can vary between two modes, aligned and

# unaligned chunk modes. By default, aligned chunk mode is selected.

# select 'yes' to enable unaligned chunk mode.

# Note: unaligned chunk mode uses hugepages, so the required number

# of pages must be available.

#mem-unaligned: no

# The following options configure the prefer-busy-polling socket

# options. The polling time and budget can be edited here.

# Possible values are:

# - yes: enable (default)

# - no: disable

#enable-busy-poll: yes

# busy-poll-time sets the approximate time in microseconds to busy

# poll on a blocking receive when there is no data.

#busy-poll-time: 20

# busy-poll-budget is the budget allowed for packet batches

#busy-poll-budget: 64

# These two tunables are used to configure the Linux OS's NAPI

# context. Their purpose is to defer enabling of interrupts and

# instead schedule the NAPI context from a watchdog timer.

# The softirq NAPI will exit early, allowing busy polling to be

# performed. Successfully setting these tunables alongside busy-polling

# should improve performance.

# Defaults are:

#gro-flush-timeout: 2000000

#napi-defer-hard-irq: 2

dpdk:

eal-params:

proc-type: primary

# DPDK capture support

# RX queues (and TX queues in IPS mode) are assigned to cores in 1:1 ratio

interfaces:

- interface: 0000:3b:00.0 # PCIe address of the NIC port

# Threading: possible values are either "auto" or number of threads

# - auto takes all cores

# in IPS mode it is required to specify the number of cores and the numbers on both interfaces must match

threads: auto

# interrupt-mode: false # true to switch to interrupt mode

promisc: true # promiscuous mode - capture all packets

multicast: true # enables also detection on multicast packets

checksum-checks: true # if Suricata should validate checksums

checksum-checks-offload: true # if possible offload checksum validation to the NIC (saves Suricata resources)

mtu: 1500 # Set MTU of the device in bytes

# rss-hash-functions: 0x0 # advanced configuration option, use only if you use untested NIC card and experience RSS warnings,

# For `rss-hash-functions` use hexadecimal 0x01ab format to specify RSS hash function flags - DumpRssFlags can help (you can see output if you use -vvv option during Suri startup)

# setting auto to rss_hf sets the default RSS hash functions (based on IP addresses)

# To approximately calculate required amount of space (in bytes) for interface's mempool: mempool-size * mtu

# Make sure you have enough allocated hugepages.

# The optimum size for the packet memory pool (in terms of memory usage) is power of two minus one: n = (2^q - 1)

mempool-size: 65535 # The number of elements in the mbuf pool

# Mempool cache size must be lower or equal to:

# - RTE_MEMPOOL_CACHE_MAX_SIZE (by default 512) and

# - "mempool-size / 1.5"

# It is advised to choose cache_size to have "mempool-size modulo cache_size == 0".

# If this is not the case, some elements will always stay in the pool and will never be used.

# The cache can be disabled if the cache_size argument is set to 0, can be useful to avoid losing objects in cache

# If the value is empty or set to "auto", Suricata will attempt to set cache size of the mempool to a value

# that matches the previously mentioned recommendations

mempool-cache-size: 257

rx-descriptors: 1024

tx-descriptors: 1024

#

# IPS mode for Suricata works in 3 modes - none, tap, ips

# - none: IDS mode only - disables IPS functionality (does not further forward packets)

# - tap: forwards all packets and generates alerts (omits DROP action) This is not DPDK TAP

# - ips: the same as tap mode but it also drops packets that are flagged by rules to be dropped

copy-mode: none

copy-iface: none # or PCIe address of the second interface

- interface: default

threads: auto

promisc: true

multicast: true

checksum-checks: true

checksum-checks-offload: true

mtu: 1500

rss-hash-functions: auto

mempool-size: 65535

mempool-cache-size: 257

rx-descriptors: 1024

tx-descriptors: 1024

copy-mode: none

copy-iface: none

# Cross platform libpcap capture support

pcap:

- interface: eth0

# On Linux, pcap will try to use mmap'ed capture and will use "buffer-size"

# as total memory used by the ring. So set this to something bigger

# than 1% of your bandwidth.

#buffer-size: 16777216

#bpf-filter: "tcp and port 25"

# Choose checksum verification mode for the interface. At the moment

# of the capture, some packets may have an invalid checksum due to

# the checksum computation being offloaded to the network card.

# Possible values are:

# - yes: checksum validation is forced

# - no: checksum validation is disabled

# - auto: Suricata uses a statistical approach to detect when

# checksum off-loading is used. (default)

# Warning: 'capture.checksum-validation' must be set to yes to have any validation

#checksum-checks: auto

# With some accelerator cards using a modified libpcap (like Myricom), you

# may want to have the same number of capture threads as the number of capture

# rings. In this case, set up the threads variable to N to start N threads

# listening on the same interface.

#threads: 16

# set to no to disable promiscuous mode:

#promisc: no

# set snaplen, if not set it defaults to MTU if MTU can be known

# via ioctl call and to full capture if not.

#snaplen: 1518

# Put default values here

- interface: default

#checksum-checks: auto

# Settings for reading pcap files

pcap-file:

# Possible values are:

# - yes: checksum validation is forced

# - no: checksum validation is disabled

# - auto: Suricata uses a statistical approach to detect when

# checksum off-loading is used. (default)

# Warning: 'checksum-validation' must be set to yes to have checksum tested

checksum-checks: auto

# See "Advanced Capture Options" below for more options, including Netmap

# and PF_RING.

##

## Step 4: App Layer Protocol configuration

##

# Configure the app-layer parsers.

#

# The exception policy error-policy setting applies to all app-layer parsers.

# Values can be "drop-flow", "pass-flow", "bypass", "drop-packet", "pass-packet",

# "reject" or "ignore" (the default).

#

# The protocol's section details each protocol.

#

# The option "enabled" takes 3 values - "yes", "no", "detection-only".

# "yes" enables both detection and the parser, "no" disables both, and

# "detection-only" enables protocol detection only (parser disabled).

app-layer:

# error-policy: ignore

protocols:

telnet:

enabled: yes

rfb:

enabled: yes

detection-ports:

dp: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909

mqtt:

enabled: yes

# max-msg-length: 1mb

# subscribe-topic-match-limit: 100

# unsubscribe-topic-match-limit: 100

# Maximum number of live MQTT transactions per flow

# max-tx: 4096

krb5:

enabled: yes

bittorrent-dht:

enabled: yes

snmp:

enabled: yes

ike:

enabled: yes

tls:

enabled: yes

detection-ports:

dp: 443

# Generate JA3/JA4 fingerprints from client hello. If not specified it

# will be disabled by default, but enabled if rules require it.

#ja3-fingerprints: auto

#ja4-fingerprints: auto

# What to do when the encrypted communications start:

# - default: keep tracking TLS session, check for protocol anomalies,

# inspect tls_* keywords. Disables inspection of unmodified

# 'content' signatures.

# - bypass: stop processing this flow as much as possible. No further

# TLS parsing and inspection. Offload flow bypass to kernel

# or hardware if possible.

# - full: keep tracking and inspection as normal. Unmodified content

# keyword signatures are inspected as well.

#

# For best performance, select 'bypass'.

#

#encryption-handling: default

pgsql:

enabled: no

# Stream reassembly size for PostgreSQL. By default, track it completely.

stream-depth: 0

# Maximum number of live PostgreSQL transactions per flow

# max-tx: 1024

dcerpc:

enabled: yes

# Maximum number of live DCERPC transactions per flow

# max-tx: 1024

ftp:

enabled: yes

# memcap: 64mb

websocket:

#enabled: yes

# Maximum used payload size, the rest is skipped

# max-payload-size: 65535

rdp:

#enabled: yes

ssh:

enabled: yes

#hassh: yes

http2:

enabled: yes

# Maximum number of live HTTP2 streams in a flow

#max-streams: 4096

# Maximum headers table size

#max-table-size: 65536

# Maximum reassembly size for header + continuation frames

#max-reassembly-size: 102400

smtp:

enabled: yes

raw-extraction: no

# Maximum number of live SMTP transactions per flow

# max-tx: 256

# Configure SMTP-MIME Decoder

mime:

# Decode MIME messages from SMTP transactions

# (may be resource intensive)

# This field supersedes all others because it turns the entire

# process on or off

decode-mime: yes

# Decode MIME entity bodies (ie. Base64, quoted-printable, etc.)

decode-base64: yes

decode-quoted-printable: yes

# Maximum bytes per header data value stored in the data structure

# (default is 2000)

header-value-depth: 2000

# Extract URLs and save in state data structure

extract-urls: yes

# Scheme of URLs to extract

# (default is [http])

#extract-urls-schemes: [http, https, ftp, mailto]

# Log the scheme of URLs that are extracted

# (default is no)

#log-url-scheme: yes

# Set to yes to compute the md5 of the mail body. You will then

# be able to journalize it.

body-md5: no

# Configure inspected-tracker for file_data keyword

inspected-tracker:

content-limit: 100000

content-inspect-min-size: 32768

content-inspect-window: 4096

imap:

enabled: detection-only

pop3:

enabled: detection-only

smb:

enabled: yes

detection-ports:

dp: 139, 445

# Maximum number of live SMB transactions per flow

# max-tx: 1024

# Stream reassembly size for SMB streams. By default track it completely.

#stream-depth: 0