Documentation #7244: userguide: explain multi-tenant default config - Suricata - Open Information Security Foundation

Actions

Copy link

Documentation #7244

open

userguide: explain multi-tenant default config

Added by Juliana Fajardini Reichow 4 months ago. Updated 4 months ago.

Status:

New

Priority:

Normal

Assignee:

Community Ticket

Target version:

TBD

Affected Versions:

Effort:

Difficulty:

Label:

Beginner, Good First Issue, Outreachy

Description

In multi-tenant mode, the engine loads one rule file per tenant, plus one rule file for non-tenants.

It is not documented in our userguide how to disable that last part. (set multi-detect.default: off)

Example yaml config showing this:

%YAML 1.1
---

multi-detect:
    enabled: on
    default: off
    selector: vlan
    loaders: 3

    tenants:
    - id: 54321
      yaml: /home/jlucovsky/yaml/tenant-1.yaml
    - id: 12345
      yaml: /home/jlucovsky/yaml/tenant-2.yaml
    - id: 3232
      yaml: /home/jlucovsky/yaml/tenant-3.yaml

    mappings:
    - vlan-id: 33
      tenant-id: 54321
    - vlan-id: 999
      tenant-id: 12345
    - vlan-id: 300
      tenant-id: 3232