Skip to content

Commit e6492ac

Browse files
0xThiebaut0xThiebaut
committed
Extend Suricata support
1 parent 3caf9e1 commit e6492ac

File tree

5 files changed

+613
-248
lines changed

5 files changed

+613
-248
lines changed

‎src/opnsense/mvc/app/controllers/OPNsense/IDS/forms/generalSettings.xml

+72-33
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,14 @@
3030
<field>
3131
<type>header</type>
3232
<label>Detection</label>
33+
<advanced>true</advanced>
3334
</field>
3435
<field>
3536
<id>ids.general.MPMAlgo</id>
3637
<label>Pattern matcher</label>
3738
<type>dropdown</type>
3839
<help>Select the multi-pattern matcher algorithm to use.</help>
40+
<advanced>true</advanced>
3941
</field>
4042
<field>
4143
<id>ids.general.detect.Profile</id>
@@ -85,6 +87,7 @@
8587
<label>Enable syslog alerts</label>
8688
<type>checkbox</type>
8789
<help>Send alerts to system log in fast log format. This will not change the alert logging used by the product itself.</help>
90+
<advanced>true</advanced>
8891
</field>
8992
<field>
9093
<id>ids.general.syslog_eve</id>
@@ -95,6 +98,7 @@
9598
This will not change the alert logging used by the product itself.
9699
Drop logs will only be send to the internal logger, due to restrictions in suricata.
97100
</help>
101+
<advanced>true</advanced>
98102
</field>
99103
<field>
100104
<id>ids.general.verbosity</id>
@@ -104,36 +108,36 @@
104108
<advanced>true</advanced>
105109
</field>
106110
<field>
107-
<id>ids.general.AlertLogrotate</id>
108-
<label>Rotate log</label>
109-
<type>dropdown</type>
110-
<help>Rotate alert logs at provided interval.</help>
111+
<id>ids.general.eveLog.types</id>
112+
<label>EVE log types</label>
113+
<type>select_multiple</type>
114+
<help>The type of events to include in the EVE log.</help>
111115
</field>
112116
<field>
113-
<id>ids.general.AlertSaveLogs</id>
114-
<label>Save logs</label>
115-
<type>text</type>
116-
<help>Number of logs to keep.</help>
117+
<id>ids.general.eveLog.extend</id>
118+
<label>EVE log extended types</label>
119+
<type>select_multiple</type>
120+
<help>The type of events which, if enabled in the EVE log, will contain extended information.</help>
117121
</field>
118122
<field>
119-
<id>ids.general.LogPayload</id>
120-
<label>Log package payload</label>
121-
<type>checkbox</type>
122-
<help>Send package payload to the log for further analyses.</help>
123+
<id>ids.general.eveLog.rotate.count</id>
124+
<label>EVE log retention count</label>
125+
<type>text</type>
126+
<help>The number of EVE logs to retain.</help>
123127
<advanced>true</advanced>
124128
</field>
125129
<field>
126-
<id>ids.general.eveLog.http.enable</id>
127-
<label>Enable eve HTTP logging</label>
128-
<type>checkbox</type>
129-
<help>Send HTTP metadata to eve-log for further analyses.</help>
130+
<id>ids.general.eveLog.rotate.size</id>
131+
<label>EVE log rotation size</label>
132+
<type>text</type>
133+
<help>Rotate EVE log past defined size in kilobytes.</help>
130134
<advanced>true</advanced>
131135
</field>
132136
<field>
133-
<id>ids.general.eveLog.http.extended</id>
134-
<label>Eve HTTP extended logging</label>
135-
<type>checkbox</type>
136-
<help>Add extended information to eve HTTP logging.</help>
137+
<id>ids.general.eveLog.rotate.frequency</id>
138+
<label>EVE log rotation frequency</label>
139+
<type>dropdown</type>
140+
<help>Rotate EVE log at defined interval.</help>
137141
<advanced>true</advanced>
138142
</field>
139143
<field>
@@ -144,31 +148,66 @@
144148
<advanced>true</advanced>
145149
</field>
146150
<field>
147-
<id>ids.general.eveLog.tls.enable</id>
148-
<label>Enable eve TLS logging</label>
151+
<id>ids.general.eveLog.tls.sessionResumption</id>
152+
<label>Eve TLS log session resumption</label>
149153
<type>checkbox</type>
150-
<help>Send TLS metadata to eve-log for further analyses.</help>
154+
<help>Output TLS transaction where the session is resumed using a session id.</help>
155+
<advanced>true</advanced>
156+
</field>
157+
<field>
158+
<id>ids.general.eveLog.tls.custom</id>
159+
<label>Eve TLS custom logging</label>
160+
<type>select_multiple</type>
161+
<help>Custom TLS fields to include in eve-log for TLS. (Overrides extended if non-empty).</help>
151162
<advanced>true</advanced>
152163
</field>
153164
<field>
154-
<id>ids.general.eveLog.tls.extended</id>
155-
<label>Eve TLS extended logging</label>
165+
<id>ids.general.eveLog.files.forceHash</id>
166+
<label>Force EVE's file hash logging</label>
167+
<type>select_multiple</type>
168+
<help>Forcefully extend file events in EVE log with the file's hash(es).</help>
169+
<advanced>true</advanced>
170+
</field>
171+
<field>
172+
<id>ids.general.eveLog.smtp.custom</id>
173+
<label>Customize EVE's SMTP logging</label>
174+
<type>select_multiple</type>
175+
<help>Extend SMTP events in EVE log with custom fields, overriding the default extended SMTP logging.</help>
176+
<advanced>true</advanced>
177+
</field>
178+
<field>
179+
<id>ids.general.eveLog.metadata.enable</id>
180+
<label>Enable EVE's metadata logging</label>
156181
<type>checkbox</type>
157-
<help>Add extended information to eve TLS logging. For example, SNI field.</help>
182+
<help>Log verbose metadata event to EVE log (i.e., triggers whenever a pktvar is saved).</help>
158183
<advanced>true</advanced>
159184
</field>
160185
<field>
161-
<id>ids.general.eveLog.tls.sessionResumption</id>
162-
<label>Eve TLS log session resumption</label>
186+
<id>ids.general.pcapLog.enable</id>
187+
<label>Enable pcap logging</label>
163188
<type>checkbox</type>
164-
<help>Output TLS transaction where the session is resumed using a session id</help>
189+
<help>Enable the logging of packets in pcap format.</help>
165190
<advanced>true</advanced>
166191
</field>
167192
<field>
168-
<id>ids.general.eveLog.tls.custom</id>
169-
<label>Eve TLS custom logging</label>
170-
<type>select_multiple</type>
171-
<help>Custom TLS fields to include in eve-log for TLS. (Overrides extended if non-empty).</help>
193+
<id>ids.general.pcapLog.limit</id>
194+
<label>Pcap file size limit</label>
195+
<type>text</type>
196+
<help>Limit the pcap file to a size in megabytes.</help>
197+
<advanced>true</advanced>
198+
</field>
199+
<field>
200+
<id>ids.general.pcapLog.maxFiles</id>
201+
<label>Pcap file count limit</label>
202+
<type>text</type>
203+
<help>Limit the amount of pcap files to retain.</help>
204+
<advanced>true</advanced>
205+
</field>
206+
<field>
207+
<id>ids.general.bpfFilter</id>
208+
<label>BPF Filter</label>
209+
<type>text</type>
210+
<help>BPF filter to apply on the interfaces (the pcap filter syntax applies here). A BPF filter should be used when logs are exported (especially pcap files) to avoid self-caused noise and amplifications.</help>
172211
<advanced>true</advanced>
173212
</field>
174213
</form>

‎src/opnsense/mvc/app/models/OPNsense/IDS/IDS.xml

+132-37
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<model>
22
<mount>//OPNsense/IDS</mount>
3-
<version>1.1.0</version>
3+
<version>1.1.1</version>
44
<description>OPNsense IDS</description>
55
<items>
66
<rules>
@@ -174,22 +174,6 @@
174174
</Model>
175175
<ValidationMessage>Related cron not found.</ValidationMessage>
176176
</UpdateCron>
177-
<AlertLogrotate type="OptionField">
178-
<Required>Y</Required>
179-
<Default>W0D23</Default>
180-
<OptionValues>
181-
<W0D23>Weekly</W0D23>
182-
<D0>Daily</D0>
183-
</OptionValues>
184-
<ValidationMessage>Please select a valid rotation</ValidationMessage>
185-
</AlertLogrotate>
186-
<AlertSaveLogs type="IntegerField">
187-
<Required>Y</Required>
188-
<Default>4</Default>
189-
<MinimumValue>1</MinimumValue>
190-
<MaximumValue>1000</MaximumValue>
191-
<ValidationMessage>Enter a valid number of logs to save</ValidationMessage>
192-
</AlertSaveLogs>
193177
<MPMAlgo type="OptionField">
194178
<BlankDesc>Default</BlankDesc>
195179
<OptionValues>
@@ -230,10 +214,6 @@
230214
<Default>0</Default>
231215
<Required>Y</Required>
232216
</syslog_eve>
233-
<LogPayload type="BooleanField">
234-
<Default>0</Default>
235-
<Required>Y</Required>
236-
</LogPayload>
237217
<verbosity type="OptionField">
238218
<BlankDesc>DEFAULT (0)</BlankDesc>
239219
<OptionValues>
@@ -244,15 +224,79 @@
244224
</OptionValues>
245225
</verbosity>
246226
<eveLog>
247-
<http>
248-
<enable type="BooleanField">
249-
<Default>0</Default>
227+
<rotate>
228+
<frequency type="OptionField">
250229
<Required>Y</Required>
251-
</enable>
252-
<extended type="BooleanField">
253-
<Default>0</Default>
230+
<Default>W0D0</Default>
231+
<OptionValues>
232+
<W0D0>Weekly</W0D0>
233+
<D0>Daily</D0>
234+
</OptionValues>
235+
<ValidationMessage>Please select a valid rotation frequency</ValidationMessage>
236+
</frequency>
237+
<size type="IntegerField">
254238
<Required>Y</Required>
255-
</extended>
239+
<Default>500000</Default>
240+
<MinimumValue>1</MinimumValue>
241+
<ValidationMessage>Enter a valid number of kilobytes</ValidationMessage>
242+
</size>
243+
<count type="IntegerField">
244+
<Required>Y</Required>
245+
<Default>4</Default>
246+
<MinimumValue>1</MinimumValue>
247+
<ValidationMessage>Enter a valid number of logs to save</ValidationMessage>
248+
</count>
249+
</rotate>
250+
<types type="OptionField">
251+
<Default>alert</Default>
252+
<OptionValues>
253+
<alert>Alerts</alert>
254+
<anomaly>Anomalies</anomaly>
255+
<http>HTTP</http>
256+
<dns>DNS</dns>
257+
<tls>TLS</tls>
258+
<files>Files</files>
259+
<smtp>SMTP</smtp>
260+
<dnp3>DNP3</dnp3>
261+
<ftp>FTP</ftp>
262+
<rdp>RDP</rdp>
263+
<nfs>NFS</nfs>
264+
<smb>SMB</smb>
265+
<tftp>TFTP</tftp>
266+
<ike>IKE</ike>
267+
<dcerpc>DCE/RPC</dcerpc>
268+
<krb5>Kerberos</krb5>
269+
<bittorrentDht>BitTorrent DHT</bittorrentDht>
270+
<snmp>SNMP</snmp>
271+
<rfb>RFB/VNC</rfb>
272+
<sip>SIP</sip>
273+
<quic>QUIC</quic>
274+
<dhcp>DHCP</dhcp>
275+
<ssh>SSH</ssh>
276+
<mqtt>MQTT</mqtt>
277+
<http2>HTTP2</http2>
278+
<pgsql>PGSQL</pgsql>
279+
<stats>Statistics</stats>
280+
<flow>Bi-Directional Flows</flow>
281+
<netflow>Uni-Directional Netflows</netflow>
282+
</OptionValues>
283+
<Multiple>Y</Multiple>
284+
</types>
285+
<extend type="OptionField">
286+
<Default>alert</Default>
287+
<OptionValues>
288+
<alert>Alerts</alert>
289+
<http>HTTP</http>
290+
<tls>TLS</tls>
291+
<files>Files</files>
292+
<smtp>SMTP</smtp>
293+
<dhcp>DHCP</dhcp>
294+
<mqtt>MQTT</mqtt>
295+
<pgsql>PGSQL</pgsql>
296+
</OptionValues>
297+
<Multiple>Y</Multiple>
298+
</extend>
299+
<http>
256300
<dumpAllHeaders type="OptionField">
257301
<OptionValues>
258302
<request>Request</request>
@@ -262,16 +306,8 @@
262306
</dumpAllHeaders>
263307
</http>
264308
<tls>
265-
<enable type="BooleanField">
266-
<Default>0</Default>
267-
<Required>Y</Required>
268-
</enable>
269-
<extended type="BooleanField">
270-
<Default>0</Default>
271-
<Required>Y</Required>
272-
</extended>
273309
<sessionResumption type="BooleanField">
274-
<Default>0</Default>
310+
<Default>1</Default>
275311
<Required>Y</Required>
276312
</sessionResumption>
277313
<custom type="OptionField">
@@ -289,11 +325,70 @@
289325
<chain>chain</chain>
290326
<ja3>ja3</ja3>
291327
<ja3s>ja3s</ja3s>
328+
<ja4>ja4</ja4>
292329
</OptionValues>
293330
<Multiple>Y</Multiple>
294331
</custom>
295332
</tls>
333+
<files>
334+
<forceHash type="OptionField">
335+
<OptionValues>
336+
<md5>md5</md5>
337+
<sha1>sha1</sha1>
338+
<sha256>sha256</sha256>
339+
</OptionValues>
340+
<Multiple>Y</Multiple>
341+
</forceHash>
342+
</files>
343+
<smtp>
344+
<custom type="OptionField">
345+
<OptionValues>
346+
<reply-to>reply-to</reply-to>
347+
<bcc>bcc</bcc>
348+
<message-id>message-id</message-id>
349+
<subject>subject</subject>
350+
<x-mailer>x-mailer</x-mailer>
351+
<user-agent>user-agent</user-agent>
352+
<received>received</received>
353+
<x-originating-ip>x-originating-ip</x-originating-ip>
354+
<in-reply-to>in-reply-to</in-reply-to>
355+
<references>references</references>
356+
<importance>importance</importance>
357+
<priority>priority</priority>
358+
<sensitivity>sensitivity</sensitivity>
359+
<organization>organization</organization>
360+
<content-md5>content-md5</content-md5>
361+
<date>date</date>
362+
</OptionValues>
363+
<Multiple>Y</Multiple>
364+
</custom>
365+
</smtp>
366+
<metadata>
367+
<enable type="BooleanField">
368+
<Default>0</Default>
369+
<Required>Y</Required>
370+
</enable>
371+
</metadata>
296372
</eveLog>
373+
<pcapLog>
374+
<enable type="BooleanField">
375+
<Default>0</Default>
376+
<Required>Y</Required>
377+
</enable>
378+
<limit type="IntegerField">
379+
<ValidationMessage>Limit should be a number.</ValidationMessage>
380+
<Required>Y</Required>
381+
<Default>1000</Default>
382+
<MinimumValue>1</MinimumValue>
383+
</limit>
384+
<maxFiles type="IntegerField">
385+
<ValidationMessage>Maximum files should be a number.</ValidationMessage>
386+
<Required>Y</Required>
387+
<Default>2000</Default>
388+
<MinimumValue>1</MinimumValue>
389+
</maxFiles>
390+
</pcapLog>
391+
<bpfFilter type="TextField"/>
297392
</general>
298393
</items>
299394
</model>

0 commit comments

Comments
 (0)