decoder-events.rules and stream-events.rules
By default, suricata.yaml includes the following rules:
- decoder-events.rules
- stream-events.rules
This results in alerts like these:
Suricata stream events example |
EXTERNAL_NET
By default, suricata.yaml sets EXTERNAL_NET to "!HOME_NET". (The Snort default in snort.conf is "EXTERNAL_NET any".) If you'd like to change this, simply make the change in /etc/nsm/NAME-OF-SENSOR/suricata.yaml and restart Suricata.
How do I edit suricata.yaml and restart Suricata?
If you have GUI access to your sensor, you can use the "IDS Config" menu entry as described here:
http://securityonion.blogspot.com/2011/09/security-onion-20110909-now-available.html
Otherwise, you can do the following:
- Modify /etc/nsm/NAME-OF-SENSOR/suricata.yaml using your favorite text editor.
- Restart Suricata using the following command:
sudo nsm --sensor --restart --only-snort-alert
No comments:
Post a Comment