view release on metacpan or  search on metacpan

share/templates/suricata_outputs.tt  view on Meta::CPAN

%YAML 1.1
---
outputs:
[% IF vars.enable_fastlog %]
  - fast:
      enabled: yes
      filename: "fast[% vars.instance_part %].log"
      append: yes
[% END %]
[% IF vars.enable_syslog %]
#
# syslog
#
  - eve-log:
      enabled: no
      filetype: syslog
      pcap-file: false
      community-id: false
      community-id-seed: 0
      xff:
        enabled: yes
        mode: extra-data
        deployment: reverse
        header: X-Forwarded-For
      types:
        - alert:
            payload: yes
            payload-buffer-size: 64kb
            packet: yes
            http-body: yes
            http-body-printable: no
            tagged-packets: yes
            metadata:
              app-layer: true
              flow: true
              rule:
                metadata: true
                raw: true
        - stats:
            totals: yes
# flows
  - eve-log:
      enabled: no
      filetype: syslog
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - anomaly:
          enabled: yes
          types:
            decode: yes
            stream: yes
            applayer: yes
          packethdr: yes
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-dns
      facility: local5
      level: Info
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - dns
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-tls
      facility: local5
      level: Info
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - tls:
            extended: yes
            custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, ja3, ja3s]
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-files
      facility: local5
      level: Info
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - files:
            force-magic: yes
            force-hash: [md5]
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-http
      facility: local5
      level: Info
      xff:
        enabled: yes
        mode: extra-data
        deployment: reverse
        header: X-Forwarded-For
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - http:
            extended: yes
            dump-all-headers: both
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-ssh
      facility: local5
      level: Info
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - ssh
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-smtp
      facility: local5
      level: Info
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - smtp:
            extended: yes
            custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-flow
      facility: local5
      level: Info
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - flow
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-nfs
      facility: local5
      level: Info
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - nfs
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-smb
      facility: local5
      level: Info
      pcap-file: false

share/templates/suricata_outputs.tt  view on Meta::CPAN

      community-id-seed: 0
      types:
        - sip
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-bittorrent-dht
      facility: local5
      level: Info
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - bittorrent-dht
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-mqtt
      facility: local5
      level: Info
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - mqtt
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-pgsql
      facility: local5
      level: Info
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - pgsql
  - eve-log:
      enabled: yes
      filetype: syslog
      identity: suricata-http2
      facility: local5
      level: Info
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - http2
[% END %]
[% IF vars.filestore_enable %]
  - file-store:
      version: 2
      enabled: yes
      dir: /var/log/suricata/files
      write-fileinfo: yes
      stream-depth: 0
      force-hash: [sha1, md5]
      xff:
        enabled: no
        mode: extra-data
        deployment: reverse
        header: X-Forwarded-For
[% END %]

##
## regular files
##
  - eve-log:
      enabled: 'yes'
      filetype: regular
      filename: /var/log/suricata/alert[% vars.instance_part %].json
      pcap-file: false
      community-id: false
      community-id-seed: 0
      xff:
        enabled: yes
        mode: extra-data
        deployment: reverse
        header: X-Forwarded-For
      types:
        - alert:
            payload: yes
            payload-buffer-size: 64kb
            packet: 'yes'
            http-body: yes
            http-body-printable: no
            tagged-packets: yes
            metadata:
              app-layer: true
              flow: true
              rule:
                metadata: true
                raw: true
        - stats:
            totals: yes
# flows
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/flows/current/anomaly.json
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - anomaly:
          enabled: yes
          types:
            decode: yes
            stream: yes
            applayer: yes
          packethdr: yes
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/flows/current/dns.json
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - dns
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/flows/current/tls.json
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - tls:
            extended: yes
            custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, ja3, ja3s]
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/flows/current/files.json
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - files:
            force-magic: yes
            force-hash: [md5]
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/flows/current/http.json
      xff:
        enabled: yes
        mode: extra-data
        deployment: reverse
        header: X-Forwarded-For
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - http:
            extended: yes
            dump-all-headers: both
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/flows/current/ssh.json
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - ssh
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/flows/current/smtp.json
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - smtp:
            extended: yes
            custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/flows/current/flow.json
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - flow
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/flows/current/nfs.json
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - nfs
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/flows/current/smb.json
      pcap-file: false
      community-id: false
      community-id-seed: 0
      types:
        - smb
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/flows/current/tftp.json
      pcap-file: false
      types: