suricata variables - syntax for setting up in the GUI

[ejgh-oe]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32

Storage for /

500

Storage for /nsm

500

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,
Today I wanted to set up some variables for suricata in order to use them in local rules.

Following #12086 I went to Administration -> Configuration > Suricata > Advanced (while making sure "Show all configuration settings" is enabled) and entered the following in the GUI:

suricata:
  config:
    vars:
      address-groups:
        DA_NODES: "[192.168.19.118,192.168.19.119]"
        NETMON: "192.168.9.30"

Guess what - after around 15min I got a grid malfunction, i.e. the sensor-node went to "Fault".

After experimenting for quite a while with various forms of writing the above definition I found out that you've got to leave out the "suricata:" clause at the top, so instead of

suricata:
  config:
    vars:
      address-groups:
        DA_NODES: "[192.168.19.118,192.168.19.119]"
        NETMON: "192.168.9.30"

it should read

config:
  vars:
    address-groups:
      DA_NODES: "[192.168.19.118,192.168.19.119]"
      NETMON: "192.168.9.30"

As soon as I got that right (i.e. no "suricata:" at the beginning) the grid went to normal again.

Maybe something worth mentioning mention in the docs?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Suricata will error if the conversion from SOC GUI to the config file fails. It will show okay in SOC becuase it is correct YAML formatted.

Try the config below:

suricata:
  config:
    vars:
      address-groups:
        DA_NODES: 
          - 192.168.19.118
          - 192.168.19.119
        NETMON: 
          - 192.168.9.30

This is what your suricata.yaml looks like with your original config with "suricata" at the top:

[root@so-standalone ~]# head -35 /opt/so/conf/suricata/suricata.yaml
%YAML 1.1
---
threading:
  set-cpu-affinity: 'no'
  cpu-affinity:
  - management-cpu-set:
      cpu:
      - 1
  - worker-cpu-set:
      cpu:
      - 2-3
      mode: exclusive
      prio:
        default: high
vars:
  address-groups:
    HOME_NET: '[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]'
    EXTERNAL_NET: '!$HOME_NET'
    HTTP_SERVERS: $HOME_NET
    SMTP_SERVERS: $HOME_NET
    SQL_SERVERS: $HOME_NET
    DNS_SERVERS: $HOME_NET
    TELNET_SERVERS: $HOME_NET
    AIM_SERVERS: $EXTERNAL_NET
    DC_SERVERS: $HOME_NET
    DNP3_SERVER: $HOME_NET
    DNP3_CLIENT: $HOME_NET
    MODBUS_CLIENT: $HOME_NET
    MODBUS_SERVER: $HOME_NET
    ENIP_CLIENT: $HOME_NET
    ENIP_SERVER: $HOME_NET
    DA_NODES: '['
    NETMON: '1'
  port-groups:
    HTTP_PORTS: 80

Hence the error in your grid, removing "suricata" will not yield a change to your suricata.yaml.

[ejgh-oe]

Great - that neatly did the trick :-):

Entered

suricata:
  config:
    vars:
      address-groups:
        DA_NODES: 
          - 192.168.19.118
          - 192.168.19.119
        NETMON: 
          - 192.168.9.30

in the GUI (i.e. single entries for IP-addresses, as opposed to "[192.168.19.118,192.168.19.119]" I had previously) and got

vars:
  address-groups:
    HOME_NET: 192.168.0.0/16
    EXTERNAL_NET: any
    HTTP_SERVERS: $HOME_NET
    SMTP_SERVERS: $HOME_NET
    SQL_SERVERS: $HOME_NET
    DNS_SERVERS: $HOME_NET
    TELNET_SERVERS: $HOME_NET
    AIM_SERVERS: $EXTERNAL_NET
    DC_SERVERS: $HOME_NET
    DNP3_SERVER: $HOME_NET
    DNP3_CLIENT: $HOME_NET
    MODBUS_CLIENT: $HOME_NET
    MODBUS_SERVER: $HOME_NET
    ENIP_CLIENT: $HOME_NET
    ENIP_SERVER: $HOME_NET
    DA_NODES: '[192.168.19.118,192.168.19.119]'
    NETMON: 192.168.9.30

Perfect - thanks much for the tipps :-)