Suricata: local rules using variables not firing

[ejgh-oe]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32

Storage for /

500

Storage for /nsm

500

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

For getting separate alerts I wanted to write a suricata rule that should fire only when traffic is coming from a certain internal host. As "internal host" is something that might change over time I wanted to use variables in my rule instead of fixed IP addresses.

To be specific:

Out of suricata's builtin rule

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL ICMP_INFO PING *NIX"; itype:8; content:"|10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F|"; depth:32; classtype:misc-activity; sid:2100366; rev:8; metadata:created_at 2010_09_23, updated_at 2019_07_26;)

I wanted to write a rule that should fire when traffic comes from 192.168.9.30. So I started out with

alert icmp 192.168.9.30 any -> $HOME_NET any (msg:"My custom GPL ICMP_INFO PING *NIX"; itype:8; content:"|10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F|"; depth:32; classtype:misc-activity; sid:9000003; rev:1; metadata:created_at 2024_02_09, updated_at 2024_09_02;)

As expected this rule got triggered and I get the alerts

Next, instead of hard coding the IP-addreess into the rule, I wanted to set a variable NETMON in suricata config and have a reference to it in my rule, i.e.

config:
  vars:
    address-groups:
      NETMON: "192.168.9.30"

and the rule being written as
alert icmp $NETMON any -> $HOME_NET any (msg:"My custom GPL ICMP_INFO PING *NIX"; itype:8; content:"|10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F|"; depth:32; classtype:misc-activity; sid:9000003; rev:1; metadata:created_at 2024_02_09, updated_at 2024_09_02;)

The defintion of the variable went to suricata > advanced and the rule to idstools > rules > local rules.

Unfortunately the rule never fired - not even after waiting for 30+ minutes.

Things I already checked:

• The new local rule correctly shows up at the end of /opt/so/rules/nids/all.rules as well as being the only rule in /opt/so/rules/nids/all.rules.
• Likewise the definition of "NETMON" (see above) shows up in/opt/so/saltstack/local/pillar/suricata/adv_suricata.slsbeing the only entry there.

Does anyone out there have an idea as to why self-defined suricata variables don't work in local rules?

Any clue is very much appreciated...

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Do you see it configure in your suricata.yaml? Do you see the IPs in that variable in there? head -35 /opt/so/conf/suricata/suricata.yaml

[ejgh-oe]

On the manager machine, there is no /opt/so/conf/suricata/suricata.yaml

# find /opt -name suricata.yaml
# 

On the sensor box I've got a suricata.yaml but head -35 /opt/so/conf/suricata/suricata.yaml doesn't contain the variable "NETMON":

vars:
  address-groups:
    HOME_NET: 192.168.0.0/16
    EXTERNAL_NET: any
    HTTP_SERVERS: $HOME_NET
    SMTP_SERVERS: $HOME_NET
    SQL_SERVERS: $HOME_NET
    DNS_SERVERS: $HOME_NET
    TELNET_SERVERS: $HOME_NET
    AIM_SERVERS: $EXTERNAL_NET
    DC_SERVERS: $HOME_NET
    DNP3_SERVER: $HOME_NET
    DNP3_CLIENT: $HOME_NET
    MODBUS_CLIENT: $HOME_NET
    MODBUS_SERVER: $HOME_NET
    ENIP_CLIENT: $HOME_NET
    ENIP_SERVER: $HOME_NET
  port-groups:
    HTTP_PORTS: 80
    SHELLCODE_PORTS: '!80'
    ORACLE_PORTS: 1521

[cm-ops]

#12336 this should be working now.