Suricata is not thresholding rules #11667
-
Version2.4.20 Installation MethodSecurity Onion ISO image Descriptioninstallation Installation TypeStandalone Locationon-prem with Internet access Hardware SpecsExceeds minimum requirements CPU8 RAM26 Storage for /200 GB Storage for /nsm1 TB Network Traffic Collectionspan port Network Traffic SpeedsLess than 1Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsNo, there are no additional clues DetailHello all, First I would like to thank the SO team for this new version, it makes a lot of things much simpler once you understand the new concept. I have been running the new version for 3 weeks now and so far I only see advantages compared to the previous version. Suricata, the threshold list entered in the configuration section of the SOC screen is not converted to the threshold.conf I use a simple threshold and used the manual as a guide Fictional example To which location is the web data written, is this the location /opt/so/conf/suricata/threshold.conf? This file is empty after a highstate I checked the suricata and highstate logs for errors but found none
Which logs can I check to see where things are going wrong? Regards Guidelines
|
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 3 replies
-
|
Where are you adding the thresholding configuration? What does the actual syntax look like? Are you trying to threshold, rate filter, or suppress? Each of those have slightly different syntax. |
Beta Was this translation helpful? Give feedback.
-
|
Hello Robbie, I add the config in the web interface in the grid configuration under suricata > thresholding > sid's. the actual syntax is like the example above and i suppres only. I used the example in the documentation for creating of the threshold config. I had a SO 2.3 running i know how to config a suricata threshold in SO when you still need to do it in the minion sls. The config used in SO 2.4 is not so different. |
Beta Was this translation helpful? Give feedback.
-
|
The link you used was a section of documentation that had not been fully updated for 2.4: That link has been updated to point to the Managing Alerts section: Please try that and see if it works. Please note that your config should start with the SID (so unlike 2.3 you shouldn't need the |
Beta Was this translation helpful? Give feedback.
-
|
Thx Doug, I changed the config and will check if the threshold works. |
Beta Was this translation helpful? Give feedback.
-
|
It works Doug. you where right it was due to the documetatiob. |
Beta Was this translation helpful? Give feedback.
The link you used was a section of documentation that had not been fully updated for 2.4:
https://docs.securityonion.net/en/2.4/suricata.html?highlight=suricata#thresholding
That link has been updated to point to the Managing Alerts section:
https://docs.securityonion.net/en/2.4/managing-alerts.html#threshold
Please try that and see if it works. Please note that your config should start with the SID (so unlike 2.3 you shouldn't need the
thresholding:andsids:lines).