Skip to content

Latest commit

 

History

History
87 lines (74 loc) · 4.94 KB

README.md

File metadata and controls

87 lines (74 loc) · 4.94 KB
Raw

Ansible Role: suricata

Ansible Role that installs an configures suricata It uses suricata-update to manage the rules

Requirements

Debian or Ubuntu. It was tested with Ubuntu 22.04

Defaults

suricata_default_tpl: "default_suricata.j2"
suricata_interface: "eth0"
suricata_tpl: "suricata.yaml.j2"

Role Variables

Variable name Type Default Description
suricata_tpl path suricata.yaml.j2 The suricata YAMl config template to be used
suricata_default_tpl default_suricata.j2 The suricata default file template to be used
suricata_threshold_tpl string threshold.config.j2 The template for the threshold.config
suricata_listenmode string af-packet Run suricata in promisous or af-packet or inline
suricata_interface list[iface] ["eth0"] The interface suricata should monitor
suricata_pcap_log bool true If suricata should save the packets in the pcap.log file
suricata_home_nets list[cidr] [192.168.0.0/16,10.0.0.0/8,172.16.0.0/12] List of home nets for this host
suricata_external_net string !$HOME_NET The external net address group
suricata_address_groups dict[string] *1 Dictionary containing address group definitions
suricata_port_groups dict[string] *2 Dictionary containing port group definitions
suricata_rule_path path /var/lib/suricata/rules The path to the rules directory
suricata_rule_files list[string] ["suricata.rules"] The rule files suricata should use
suricata_extra_rule_files list[path] [] List of additional rule files to install on the host
suricata_classification_file path /etc/suricata/classification.config The path to the classification file
suricata_reference_config_file path /etc/suricata/reference.config The path to the reference config file
suricata_threshold_file path /etc/suricata/threshold.config The path to the threshold config file
suricata_log_dir path /var/log/suricata/ The default suricata log directory
suricata_threshold list[dict] [] The rules for the treshold.config
suricata_update_rules list[string] List of suricata update rules to enable
community_id_enabled bool true If suricata should use a community id for flows
community_id_seed int 0 Seed for community id
netflow_enabled bool false If suricata should generate netflow records

*1

suricata_address_groups:
    HTTP_SERVERS: "$HOME_NET"
    SMTP_SERVERS: "$HOME_NET"
    SQL_SERVERS: "$HOME_NET"
    DNS_SERVERS: "$HOME_NET"
    TELNET_SERVERS: "$HOME_NET"
    AIM_SERVERS: "$EXTERNAL_NET"
    DNP3_SERVER: "$HOME_NET"
    DNP3_CLIENT: "$HOME_NET"
    MODBUS_CLIENT: "$HOME_NET"
    MODBUS_SERVER: "$HOME_NET"
    ENIP_CLIENT: "$HOME_NET"
    ENIP_SERVER: "$HOME_NET"

*2

suricata_port_groups:
    HTTP_PORTS: "80"
    SHELLCODE_PORTS: "!80"
    ORACLE_PORTS: 1521
    SSH_PORTS: 22
    DNP3_PORTS: 20000
    MODBUS_PORTS: 502

Use

- hosts: localhost
  roles:
    - suricata
  vars:
    suricata_interface: "enp0s3"
    suricata_threshold:
      - { rule: 'threshold gen_id 0, sig_id 0, type threshold, track by_src, count 10, seconds 10', comment: 'Some important rule' }
      - { rule: 'suppress gen_id 1, sig_id 2009557, track by_src, ip 217.110.97.128/25' }
      - { rule: 'suppress gen_id 1, sig_id 2012086, track by_src, ip 217.110.97.128/25' }