SO API for Managing Alerts

[jblackley]

Does Security Onion have an API for managing alerts? I realize Security Onion has many components, so maybe it's a question of whether a specific component has an API. But I'm not sure which component(s) I need to be looking at.

What I would like to do is manage rules/alerts from a web interface instead of the sls file. I'm comfortable with manipulating the file. But after we finalize turn-up, other people will be responsible for everyday use and they won't have SSH access. As an example, rule 2027758 is just noise to us and we want to add it to idstools/sids/disabled. Then my coworkers would go to this custom web interface, click a few buttons, and be done with .cc DNS lookup alerts.

We have a programmer who can create the web interface. He already added a pop-up window to Security Onion by right-clicking on the Acknowledge bell.

It is supposed to work by talking on port 5721, but the connection is never made. I assume it's Security Onion firewall rules. I made a few changes, but still didn't get it going. I decided to undo my changes before I broke something.

I figure all of this would be much easier with an external web interface and using an API... aside from the fact that any Security Onion interface changes may be lost with upgrades. So:

1. Does Security Onion (as a package) have an API that allows alert management? I assume not, because I didn't find any documentation on it.
2. Do I need to look at the individual Security Onion services instead?
3. I saw that Suricata does have an API. I assume that's where rules/alerts are handled. But is it just Suricata? Or are other services involved?
4. If it is just Suricata, will the API documentation found elsewhere on the internet still be applicable? Or has the Security Onion integration somehow affected Suricata API use? For example, CentOS has iptables, but with Security Onion you should use so-allow or so-firewall which, in turn, configure iptables. Has Security Onion done anything similar with the Suricata API.

[InfosecGoon]

There is not an API for managing alerting rules -- that said, one major change coming in 2.4 is the shift of this sort of tuning activity from SSH to the web interface. Have you had a chance to test out any of the public betas yet?

[jblackley]

Nice! No, I haven't done anything with betas. I'm a noob at Security Onion. I'm doing good to understand how all the backend stuff works together on an official release. I can't imagine working through a bug. And for whatever reason, I tend to find bugs in things. But having advanced tuning in the web interface is worth giving it a shot. Thanks InfosecGoon!