Project

General

Profile

Actions
Copy link

Feature #1229

closed

Suricata alerts in CEF Format

Added by Giacomo Milani over 10 years ago. Updated almost 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

Many different security vendors of network security devices, log collector and correlation engines are now supporting an interoperability logging standard called CEF ( Common Event Format ).

Align the logging output will improve the interoperability and aims to ease correlate events generated from different devices.

Despite it’s possibile to convert suricata unified2 events with barnyard2 to CEF i’m interested to develop native CEF support, to remove dependency of a third party software and to reduce i/o pressure and latency introduced by format conversion.

CEF is a text format and it can be logged raw to file or transported by syslog without breaking its standard.

An example of CEF event is the following one:

CEF:0|OISF|Suricata|2.0.1|1:9221001:1|Generic Protocol Command Decode|3|rt=14038633490004 act=alert proto=TCP src=141.76.x.x spt=80 dst=172.16.226.150 dpt=60134 msg=SURICATA test service=http method=GET request=/debian/pool/main/i/irssi/irssi_0.8.15-5_amd64.deb host=ftp.de.debian.org agent=Debian APT-HTTP/1.3 (0.9.7.9) status=200 contentLen=1152622 contentType=application/x-debian-package server=Apache/2.2.22 (Debian)

The event contains common information already present in fast.log, device vendor and device name (OSIF/Suricata) and if it’s possibile it will display also some key/values extracted by the application layer (identified by service= label).

Documentation of CEF format can be found at the following link: https://kc.mcafee.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/78000/KB78712/en_US/CEF_White_Paper_20100722.pdf

Actions
Copy link
 #1

Updated by Andreas Herz over 7 years ago

Does anyone have more insight about that? Is it really used that much and something we might want to add?

Actions
Copy link
 #2

Updated by Kile Morgan over 7 years ago

CEF is used a lot with ArcSight, however ArcSight also has a JSON file and folder follower flex connector. I just asked the Arc Sight guy and even if you did output in CEF you might still need to write PCRE to map values into Arc Sight(that was our biggest problem and why we went JSON). Just my two cents.....

Actions
Copy link
 #3

Updated by Victor Julien almost 3 years ago

  • Status changed from New to Closed
  • Assignee deleted (Giacomo Milani)
  • Target version deleted (TBD)

Now that we support output plugins, I think we can close this. Either through a plugin or through a eve to xxx convertor outside of Suricata this can be made to work. I don't see a place for it in Suricata itself.

Actions
Copy link

Also available in: Atom PDF