Tools/Suricata-Logger
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V0.1.0 Suricata Logger

Browse Source 
Modified:
- .gitignore: ignoring lua files
- suricata.rules: added a rule to log every packet
- suricata.yaml: specified alerts to dump whole
    packet bytes
This commit is contained in:
Christian Risi 2025-06-05 10:27:29 +02:00
parent c3bc1d993e
commit b02370a69a
3 changed files with 19 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
.gitignore vendored
View File

@ -20,3 +20,9 @@ _tmp/
# tsconfig for bun # tsconfig for bun
/tsconfig.json /tsconfig.json
# Lua
lua_modules/
.luarocks/
lua
core

1
suricata/suricata.rules
View File

@ -1 +1,2 @@
alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;)
alert ip any any -> any any (msg:"General Logging"; sid:12;)

14
suricata/suricata.yaml
View File

@ -153,13 +153,13 @@ outputs:
types: types:
- alert: - alert:
# payload: yes # enable dumping payload in Base64 payload: yes # enable dumping payload in Base64
# payload-buffer-size: 4kb # max size of payload buffer to output in eve-log payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
# payload-printable: yes # enable dumping payload in printable (lossy) format payload-printable: yes # enable dumping payload in printable (lossy) format
# packet: yes # enable dumping of packet (without stream segments) packet: yes # enable dumping of packet (without stream segments)
# metadata: no # enable inclusion of app layer metadata with alert. Default yes metadata: no # enable inclusion of app layer metadata with alert. Default yes
# http-body: yes # Requires metadata; enable dumping of HTTP body in Base64 http-body: yes # Requires metadata; enable dumping of HTTP body in Base64
# http-body-printable: yes # Requires metadata; enable dumping of HTTP body in printable format http-body-printable: yes # Requires metadata; enable dumping of HTTP body in printable format
# Enable the logging of tagged packets for rules using the # Enable the logging of tagged packets for rules using the
# "tag" keyword. # "tag" keyword.