Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve suricata doc #1781

Merged
merged 4 commits into from
May 14, 2024
Merged

Improve suricata doc #1781

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
73a6ea6
Improve suricata doc
pbivic May 14, 2024
7c91d66
upper case
pbivic May 14, 2024
dba7d55
Better preview
pbivic May 14, 2024
d94ef86
Update suricata.md
CharlesLR-sekoia May 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions docs/xdr/features/collect/integrations/network/suricata.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,10 @@ Suricata is a free and open source, mature, fast and robust network threat detec
{!_shared_content/operations_center/integrations/generated/331fa58d-8cf9-454a-a87f-48a3dc07d4d3.md!}

## Configure
Suricata leverages its EVE output module to report alerts, metadata, file info and protocol records in JSON. As described in the official documentation, this module can report its findings through the syslog facility.
Suricata leverages its EVE output module to report alerts, metadata, file info and protocol records in JSON. As described in the [official documentation](https://docs.suricata.io/en/latest/configuration/suricata-yaml.html), this module can report its findings through the [syslog](https://docs.suricata.io/en/latest/output/eve/eve-json-output.html#output-types) facility.

### Configure Suricata to forward events to rsyslog
Open the Suricata configuration file (please note that the path to the configuration file may change depending on the OS and your configuration):
### Configure log settings
Open the Suricata configuration file: `suricata.yaml` (please note that the path to the configuration file may change depending on the OS and your configuration):
```bash
sudo vim /etc/suricata/suricata.yaml
```
Expand All @@ -35,8 +35,13 @@ outputs:
- tls
```

### Configure the Rsyslog server
Given this Suricata configuration, your local rsyslog server will handle produced records. Please consult the [Rsyslog Transport](../../../ingestion_methods/syslog/overview/) documentation to forward these logs to Sekoia.io.
### Forward logs to Sekoia
Given this Suricata configuration, your local built-in rsyslog service will handle produced records.
Once your Suricata is configured to log threw syslog you have many options to forward those logs to Sekoia.io app. All of those solutions have their advantages. You will find more details about the type of events that are handled by each of them and how to set up those solutions on the dedicated documentations that follows:

- [Collect logs in files with Sekoia.io agent and send them directly to Sekoia.io via HTTP](https://docs.sekoia.io/xdr/features/collect/integrations/endpoint/sekoiaio/#collect-logs-in-files)
- [Forward local logs to a central Sekoia.io Forwarder prior to be transfered to Sekoia.io via Syslog](https://docs.sekoia.io/xdr/features/collect/ingestion_methods/sekoiaio_forwarder/)
- [Update the local Rsyslog to send updated logs to a central Sekoia.io Forwarder or directly to Sekoia.io via Syslog](https://docs.sekoia.io/xdr/features/collect/ingestion_methods/syslog/rsyslog/)

## Further Readings
- [Suricata User Guide](https://suricata.readthedocs.io/)
Loading