Project

General

Profile

Download (3.81 KB)

Bug #1550 » evil.yaml

Alessandro Guido, 09/17/2015 04:00 AM

 
%YAML 1.1
---

max-pending-packets: 65534
runmode: worker

threading:
set-cpu-affinity: yes
cpu-affinity:
- receive-cpu-set:
cpu: ["all"]
mode: "exclusive"
prio:
default: "high"
- detect-cpu-set:
cpu: ["all"]
mode: "exclusive"
prio:
default: "high"

default-packet-size: 1518

af-packet:
- interface: mbut1
threads: 12
cluster-id: 99
cluster-type: cluster_cpu
defrag: no
checksum-checks: no
use-mmap: yes
ring-size: 500000


default-log-dir: /var/log/suricata
logging:
default-log-level: info
outputs:
- console:
enabled: no
- file:
enabled: no
append: yes
filename: logs/suricata.log

outputs:
- unified2-alert:
enabled: no
filename: alerts/u2
limit: 3mb
payload: no

- eve-log:
enabled: no
filename: logs/eve.json
types:
- alert
- dns
- http

- stats:
enabled: no
filename: logs/suricata-stats.log
interval: 10
append: no

- eve-log:
enabled: yes
filename: events/alert.json
append: yes
types:
- alert:
payload: yes

- eve-log:
enabled: yes
filename: events/dns.json
append: yes
types:
- dns

- eve-log:
enabled: yes
filename: events/http.json
append: yes
types:
- http:
extended: yes

- eve-log:
enabled: yes
filename: events/stats.json
append: yes
types:
- stats:
totals: yes
threads: no
deltas: yes

- eve-log:
enabled: yes
filename: events/flows.json
append: yes
types:
- flow

magic-file: /usr/share/misc/magic.mgc

legacy:
uricontent: enabled

defrag:
max-frags: 1024
prealloc: 1000
timeout: 60

flow:
memcap: 100mb
hash-size: 32768
prealloc: 25000
emergency-recovery: 30

stream:
checksum-validation: no
midstream: yes
async-oneside: yes
memcap: 200mb
reassembly:
memcap: 32gb
depth: 0


detect-engine:
- profile: medium

default-rule-path: /var/lib/suricata

rule-files:
- evil.rules

threshold-file: /etc/suricata/threshold.conf
classification-file: /etc/suricata/classification.config
reference-config-file: /etc/suricata/reference.config

action-order:
- pass
- drop
- reject
- alert

vars:
address-groups:
HOME_NET: "[10.8.0.0/16]"
EXTERNAL_NET: "any"
DNS_SERVERS: "$HOME_NET"
SMTP_SERVERS: "$HOME_NET"
HTTP_SERVERS: "$HOME_NET"
SQL_SERVERS: "$HOME_NET"
TELNET_SERVERS: "$HOME_NET"
SIP_SERVERS: "$HOME_NET"
# do not modify
AIM_SERVERS: "[64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]"

port-groups:
HTTP_PORTS: "[36,80,81,82,83,84,85,86,87,88,89,90,311,383,555,591,593,631,801,808,818,901,972,1158,1220,1414,1533,1741,1830,2231,2301,2381,2809,3029,3037,3057,3128,3443,3702,4000,4343,4848,5117,5250,6080,6173,6988,7000,7001,7071,7144,7145,7510,7770,7777,7779,8000,8008,8014,8028,8080,8081,8082,8085,8088,8090,8118,8123,8180,8181,8222,8243,8280,8300,8500,8509,8800,8888,8899,9000,9060,9080,9090,9091,9111,9443,9999,10000,11371,12601,15489,29991,33300,34412,34443,34444,41080,44449,50000,50002,51423,53331,55252,55555,56712]"
SHELLCODE_PORTS: "[!80]"
ORACLE_PORTS: "[1024:]"
SSH_PORTS: "[22,443]"
FTP_PORTS: "[21,2100,3535]"
SIP_PORTS: "[5060,5061,5600]"
FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
GTP_PORTS: "[2123,2152,3386]"


host-os-policy:
# Make the default policy windows.
windows: [0.0.0.0/0]
bsd: []
bsd-right: []
old-linux: []
linux: []
old-solaris: []
solaris: []
hpux10: []
hpux11: []
irix: []
macos: []
vista: []
windows2k3: []
(4-4/4)