search

Suricata configuration

This article provides a sample suricata.yaml file that is the configuration file used by Vectra Sensors that run Vectra Match.

hashtag
Please note the following:

  • Different Sensor configurations (numbers of cpu cores, memory, etc) will have different thread and CPU settings in the suricata.yaml file.

  • Vectra automatically populates the HOME_NET variable based on the configuration defined in the:

    • Internal IP Addresses (CIDR) - "Internal subnet"

      • Viewable in your Vectra UI at Configuration → COVERAGE → Data Sources → Network → Brain Setup → IP Address Classification

    • Excluded Subnet of Internal IP Addresses (CIDR) - "Excluded subnet"

      • Viewable in your Vectra UI at Configuration → COVERAGE → Data Sources → Network → Brain Setup → IP Address Classification

    • Automatically discovered Southside Proxy IPs

      • Viewable at the CLI of your Brain with show proxy --southside command.

    • For Example:

      • If you have 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as your Internal subnets

      • And 10.0.0.1, 10.0.0.2, 10.0.0.3 as Southside Proxy IP's,

      • And you've excluded 10.254.1.0/24 in the Excluded subnet,

      • The HOME_NET variable would look like:

        • [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16,!PROXY_IPs,!EXCLUDE_NET]

      • With PROXY_IPs being [10.0.0.1, 10.0.0.2, 10.0.0.3]

      • And EXCLUDE_NET would be [10.254.1.0/24]

  • In addition to the HOME_NET Variable, Vectra supports the following variables:

    • EXTERNAL_NET variable is [!HOME_NET, PROXY_IPs, EXCLUDE_NET]

    • PROXY_IPs is a list of IP's that are automatically added to the PROXY_IPs variable if detected by Vectra's Southside proxy detection.

      • Northside proxies are not factored in here.

      • This variable was introduced in 9.0 and enables users to automatically treat any traffic sent to Proxies as External even if they have an internal address.

      • You can view the list of Southside proxies on the Brain CLI using show proxy --southside

    • EXCLUDE_NET

      • The EXCLUDE_NET variable is automatically populated via the Excluded Subnet configuration under Configuration → COVERAGE → Data Sources → Network → Brain Setup → IP Address Classification

  • Customers may use any of the supported Variables (HOME_NET, PROXY_IPs, EXCLUDE_NET, and EXTERNAL_NET) in your own rules.

  • If you have further custom variables, you can always resolve them into the IP netblocks and use those in the rules instead, as this is all that Suricata does when a variable is in the Suricata.yaml file.

hashtag
Example internal_networks.yaml file:

This example file is based on what the Configuration → COVERAGE → Data Sources → Network → Brain Setup > IP Address Classification > Internal IP Addresses (CIDR) contains. The contents of this file is updated every time the data changes or the system discovers new south-side proxies. This file in the included in the underlying Suricata configuration so the variables describe in the prior section can be used in rules.

hashtag
Example suricata.yaml configuration file (as of v9.1):

PreviousPerformance and rulset optimizationNextStream

Last updated

Was this helpful?