Skip to content

Commit e03cb57

Browse files
0xThiebaut0xThiebaut
committed
Extend Suricata support
1 parent 3caf9e1 commit e03cb57

File tree

5 files changed

+580
-272
lines changed

5 files changed

+580
-272
lines changed

‎src/opnsense/mvc/app/controllers/OPNsense/IDS/forms/generalSettings.xml

+91-57
Original file line numberDiff line numberDiff line change
@@ -5,76 +5,73 @@
55
</field>
66
<field>
77
<id>ids.general.enabled</id>
8-
<label>Enabled</label>
8+
<label>Enable</label>
99
<type>checkbox</type>
10-
<help>Enable intrusion detection system.</help>
10+
<help>Enable IDS (Intrusion Detection System).</help>
1111
</field>
1212
<field>
1313
<id>ids.general.ips</id>
1414
<label>IPS mode</label>
1515
<type>checkbox</type>
16-
<help><![CDATA[Enable protection mode (block traffic).<br />Before enabling, please disable all hardware offloading first <a href="/system_advanced_network.php">in advanced network</a>.]]></help>
16+
<help><![CDATA[Enable IPS (Intrusion Prevention System) mode to block traffic.<br />Before enabling, please disable all hardware offloading first <a href="/system_advanced_network.php">in advanced network</a>.]]></help>
1717
</field>
1818
<field>
1919
<id>ids.general.promisc</id>
2020
<label>Promiscuous mode</label>
2121
<type>checkbox</type>
22-
<help>Enable promiscuous mode, for certain setups (like IPS with vlans), this is required to actually capture data on the physical interface.</help>
22+
<help>Enable promiscuous mode, for certain setups (e.g., IPS with VLANs) this is required to actually capture data on the physical interface.</help>
2323
</field>
2424
<field>
2525
<id>ids.general.interfaces</id>
2626
<label>Interfaces</label>
2727
<type>select_multiple</type>
2828
<help>Select interface(s) to use. When enabling IPS, make sure the (virtual) driver supports this feature.</help>
2929
</field>
30-
<field>
31-
<type>header</type>
32-
<label>Detection</label>
33-
</field>
3430
<field>
3531
<id>ids.general.MPMAlgo</id>
3632
<label>Pattern matcher</label>
3733
<type>dropdown</type>
38-
<help>Select the multi-pattern matcher algorithm to use.</help>
34+
<help>Select the multi-pattern matcher algorithm to use for the engine's scan/search.</help>
35+
<advanced>true</advanced>
3936
</field>
4037
<field>
4138
<id>ids.general.detect.Profile</id>
42-
<label>Detect Profile</label>
39+
<label>Detection profile</label>
4340
<type>dropdown</type>
44-
<advanced>true</advanced>
4541
<help>The detection engine builds internal groups of signatures. The engine allow us to specify the profile to use for them, to manage memory on an efficient way keeping a good performance.</help>
42+
<advanced>true</advanced>
4643
</field>
4744
<field>
4845
<id>ids.general.detect.toclient_groups</id>
49-
<label>ToClient</label>
46+
<label>ToClient groups</label>
5047
<style>detect_custom</style>
5148
<type>text</type>
49+
<help>The number of groups for signatures to a client. The detection engine tries to split out separate signatures into groups so that a packet is only inspected against signatures that can actually match. As in large rule set this would result in way too many groups and memory usage similar groups are merged together.</help>
5250
<advanced>true</advanced>
53-
<help>If Custom is specified. The detection engine tries to split out separate signatures into groups so that a packet is only inspected against signatures that can actually match. As in large rule set this would result in way too many groups and memory usage similar groups are merged together.</help>
5451
</field>
5552
<field>
5653
<id>ids.general.detect.toserver_groups</id>
57-
<label>ToServer</label>
54+
<label>ToServer groups</label>
5855
<style>detect_custom</style>
5956
<type>text</type>
57+
<help>The number of groups for signatures to a server. The detection engine tries to split out separate signatures into groups so that a packet is only inspected against signatures that can actually match. As in large rule set this would result in way too many groups and memory usage similar groups are merged together.</help>
6058
<advanced>true</advanced>
61-
<help>If Custom is specified. The detection engine tries to split out separate signatures into groups so that a packet is only inspected against signatures that can actually match. As in large rule set this would result in way too many groups and memory usage similar groups are merged together.</help>
6259
</field>
6360
<field>
6461
<id>ids.general.homenet</id>
6562
<label>Home networks</label>
6663
<type>select_multiple</type>
6764
<style>tokenize</style>
6865
<allownew>true</allownew>
69-
<help>Networks to interpret as local</help>
66+
<help>Networks to interpret as local.</help>
7067
<advanced>true</advanced>
7168
</field>
7269
<field>
7370
<id>ids.general.defaultPacketSize</id>
74-
<label>default packet size</label>
71+
<label>Default packet size</label>
7572
<type>text</type>
76-
<advanced>true</advanced>
7773
<help>With this option, you can set the size of the packets on your network. It is possible that bigger packets have to be processed sometimes. The engine can still process these bigger packets, but processing it will lower the performance.</help>
74+
<advanced>true</advanced>
7875
</field>
7976
<field>
8077
<type>header</type>
@@ -85,90 +82,127 @@
8582
<label>Enable syslog alerts</label>
8683
<type>checkbox</type>
8784
<help>Send alerts to system log in fast log format. This will not change the alert logging used by the product itself.</help>
85+
<advanced>true</advanced>
8886
</field>
8987
<field>
9088
<id>ids.general.syslog_eve</id>
91-
<label>Enable eve syslog output</label>
89+
<label>Enable EVE syslog output</label>
9290
<type>checkbox</type>
9391
<help>
94-
Send alerts in eve format to syslog, using log level info.
92+
Send alerts in EVE format to syslog, using the log level info.
9593
This will not change the alert logging used by the product itself.
96-
Drop logs will only be send to the internal logger, due to restrictions in suricata.
94+
Drop logs will only be sent to the internal logger, due to restrictions in Suricata.
9795
</help>
96+
<advanced>true</advanced>
9897
</field>
9998
<field>
10099
<id>ids.general.verbosity</id>
101100
<label>Syslog verbosity</label>
102101
<type>dropdown</type>
103-
<help>Increase the verbosity of the Suricata application logging by increasing the log level from the default.</help>
102+
<help>Increase the verbosity of the Suricata application logging by increasing the default log level.</help>
104103
<advanced>true</advanced>
105104
</field>
106105
<field>
107-
<id>ids.general.AlertLogrotate</id>
108-
<label>Rotate log</label>
109-
<type>dropdown</type>
110-
<help>Rotate alert logs at provided interval.</help>
106+
<id>ids.general.eveLog.types</id>
107+
<label>EVE log types</label>
108+
<type>select_multiple</type>
109+
<help>The type of events to include in the EVE log.</help>
111110
</field>
112111
<field>
113-
<id>ids.general.AlertSaveLogs</id>
114-
<label>Save logs</label>
115-
<type>text</type>
116-
<help>Number of logs to keep.</help>
112+
<id>ids.general.eveLog.extend</id>
113+
<label>EVE log extended types</label>
114+
<type>select_multiple</type>
115+
<help>The type of events which, if enabled in the EVE log, will contain extended information.</help>
117116
</field>
118117
<field>
119-
<id>ids.general.LogPayload</id>
120-
<label>Log package payload</label>
121-
<type>checkbox</type>
122-
<help>Send package payload to the log for further analyses.</help>
118+
<id>ids.general.eveLog.rotate.count</id>
119+
<label>EVE log retention count</label>
120+
<type>text</type>
121+
<help>The number of EVE logs to retain.</help>
123122
<advanced>true</advanced>
124123
</field>
125124
<field>
126-
<id>ids.general.eveLog.http.enable</id>
127-
<label>Enable eve HTTP logging</label>
128-
<type>checkbox</type>
129-
<help>Send HTTP metadata to eve-log for further analyses.</help>
125+
<id>ids.general.eveLog.rotate.size</id>
126+
<label>EVE log rotation size</label>
127+
<type>text</type>
128+
<help>Rotate EVE log past defined size in kilobytes.</help>
130129
<advanced>true</advanced>
131130
</field>
132131
<field>
133-
<id>ids.general.eveLog.http.extended</id>
134-
<label>Eve HTTP extended logging</label>
135-
<type>checkbox</type>
136-
<help>Add extended information to eve HTTP logging.</help>
132+
<id>ids.general.eveLog.rotate.frequency</id>
133+
<label>EVE log rotation frequency</label>
134+
<type>dropdown</type>
135+
<help>Rotate EVE log at defined interval.</help>
137136
<advanced>true</advanced>
138137
</field>
139138
<field>
140139
<id>ids.general.eveLog.http.dumpAllHeaders</id>
141-
<label>Eve HTTP dump all headers</label>
140+
<label>Enable EVE's HTTP header logging</label>
142141
<type>dropdown</type>
143-
<help>Make eve HTTP logging dump all HTTP headers. You may choose to dump headers for requests or responses or both.</help>
142+
<help>Dump all, request, or response headers from HTTP events in EVE log.</help>
144143
<advanced>true</advanced>
145144
</field>
146145
<field>
147-
<id>ids.general.eveLog.tls.enable</id>
148-
<label>Enable eve TLS logging</label>
146+
<id>ids.general.eveLog.tls.sessionResumption</id>
147+
<label>Enable EVE's TLS session resumption logging</label>
149148
<type>checkbox</type>
150-
<help>Send TLS metadata to eve-log for further analyses.</help>
149+
<help>Log TLS events with session resumptions to EVE log (i.e., transactions with a session identifier).</help>
150+
<advanced>true</advanced>
151+
</field>
152+
<field>
153+
<id>ids.general.eveLog.tls.custom</id>
154+
<label>Customize EVE's TLS logging</label>
155+
<type>select_multiple</type>
156+
<help>Extend TLS events in EVE log with custom fields, overriding the default extended TLS logging.</help>
157+
<advanced>true</advanced>
158+
</field>
159+
<field>
160+
<id>ids.general.eveLog.files.forceHash</id>
161+
<label>Force EVE's file hash logging</label>
162+
<type>select_multiple</type>
163+
<help>Forcefully extend file events in EVE log with the file's hash(es).</help>
164+
<advanced>true</advanced>
165+
</field>
166+
<field>
167+
<id>ids.general.eveLog.smtp.custom</id>
168+
<label>Customize EVE's SMTP logging</label>
169+
<type>select_multiple</type>
170+
<help>Extend SMTP events in EVE log with custom fields, overriding the default extended SMTP logging.</help>
151171
<advanced>true</advanced>
152172
</field>
153173
<field>
154-
<id>ids.general.eveLog.tls.extended</id>
155-
<label>Eve TLS extended logging</label>
174+
<id>ids.general.eveLog.metadata.enable</id>
175+
<label>Enable EVE's metadata logging</label>
156176
<type>checkbox</type>
157-
<help>Add extended information to eve TLS logging. For example, SNI field.</help>
177+
<help>Log verbose metadata event to EVE log (i.e., triggers whenever a pktvar is saved).</help>
158178
<advanced>true</advanced>
159179
</field>
160180
<field>
161-
<id>ids.general.eveLog.tls.sessionResumption</id>
162-
<label>Eve TLS log session resumption</label>
181+
<id>ids.general.pcapLog.enable</id>
182+
<label>Enable pcap logging</label>
163183
<type>checkbox</type>
164-
<help>Output TLS transaction where the session is resumed using a session id</help>
184+
<help>Enable the logging of packets in pcap format.</help>
165185
<advanced>true</advanced>
166186
</field>
167187
<field>
168-
<id>ids.general.eveLog.tls.custom</id>
169-
<label>Eve TLS custom logging</label>
170-
<type>select_multiple</type>
171-
<help>Custom TLS fields to include in eve-log for TLS. (Overrides extended if non-empty).</help>
188+
<id>ids.general.pcapLog.limit</id>
189+
<label>Pcap file size limit</label>
190+
<type>text</type>
191+
<help>Limit the pcap file to a size in megabytes.</help>
192+
<advanced>true</advanced>
193+
</field>
194+
<field>
195+
<id>ids.general.pcapLog.maxFiles</id>
196+
<label>Pcap file count limit</label>
197+
<type>text</type>
198+
<help>Limit the amount of pcap files to retain.</help>
199+
<advanced>true</advanced>
200+
</field>
201+
<field>
202+
<id>ids.general.bpfFilter</id>
203+
<label>BPF Filter</label>
204+
<type>text</type>
205+
<help>BPF filter to apply on the interfaces (the pcap filter syntax applies here). A BPF filter should be used when logs are exported (especially pcap files) to avoid self-caused noise and amplifications.</help>
172206
<advanced>true</advanced>
173207
</field>
174208
</form>

0 commit comments

Comments
 (0)