blob: 8c1973567c1957fc82da43f8c487de645946089a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
|
<?xml version="1.0"?>
<interfaceDefinition>
<node name="service">
<children>
<node name="ids">
<children>
<node name="suricata" owner="${vyos_conf_scripts_dir}/service_ids_suricata.py">
<properties>
<help>Network IDS, IPS and Network Security Monitoring</help>
<priority>740</priority>
</properties>
<children>
#include <include/generic-interface-multi.xml.i>
<tagNode name="address-group">
<properties>
<help>Address group name</help>
<completionHelp>
<list>home-net external-net http-servers smtp-servers sql-servers dns-servers telnet-servers aim-servers dc-servers dnp3-server dnp3-client modbus-client modbus-server enip-client enip-server</list>
</completionHelp>
<constraint>
<regex>[a-z0-9-]+</regex>
</constraint>
</properties>
<children>
<leafNode name="address">
<properties>
<help>IP address or subnet</help>
<valueHelp>
<format>ipv4</format>
<description>IPv4 address to match</description>
</valueHelp>
<valueHelp>
<format>ipv6</format>
<description>IPv6 address to match</description>
</valueHelp>
<valueHelp>
<format>ipv4net</format>
<description>IPv4 prefix to match</description>
</valueHelp>
<valueHelp>
<format>ipv6net</format>
<description>IPv6 prefix to match</description>
</valueHelp>
<valueHelp>
<format>!ipv4</format>
<description>Exclude the specified IPv4 address from matches</description>
</valueHelp>
<valueHelp>
<format>!ipv6</format>
<description>Exclude the specified IPv6 address from matches</description>
</valueHelp>
<valueHelp>
<format>!ipv4net</format>
<description>Exclude the specified IPv6 prefix from matches</description>
</valueHelp>
<valueHelp>
<format>!ipv6net</format>
<description>Exclude the specified IPv6 prefix from matches</description>
</valueHelp>
<constraint>
<validator name="ipv4-address"/>
<validator name="ipv6-address"/>
<validator name="ipv4-prefix"/>
<validator name="ipv6-prefix"/>
<validator name="ipv4-address-exclude"/>
<validator name="ipv6-address-exclude"/>
<validator name="ipv4-prefix-exclude"/>
<validator name="ipv6-prefix-exclude"/>
</constraint>
<multi/>
</properties>
</leafNode>
<leafNode name="group">
<properties>
<help>Address group</help>
<completionHelp>
<path>service ids suricata address-group</path>
<list>home-net external-net http-servers smtp-servers sql-servers dns-servers telnet-servers aim-servers dc-servers dnp3-server dnp3-client modbus-client modbus-server enip-client enip-server</list>
</completionHelp>
<valueHelp>
<format>string</format>
<description>Address group to match</description>
</valueHelp>
<valueHelp>
<format>!string</format>
<description>Exclude the specified address group from matches</description>
</valueHelp>
<constraint>
<regex>!?[a-z0-9-]+</regex>
</constraint>
<multi/>
</properties>
</leafNode>
</children>
</tagNode>
<tagNode name="port-group">
<properties>
<help>Port group name</help>
<completionHelp>
<list>http-ports shellcode-ports oracle-ports ssh-ports dnp3-ports modbus-ports file-data-ports ftp-ports geneve-ports vxlan-ports teredo-ports</list>
</completionHelp>
<constraint>
<regex>[a-z0-9-]+</regex>
</constraint>
</properties>
<children>
<leafNode name="port">
<properties>
<help>Port number</help>
<valueHelp>
<format>u32:1-65535</format>
<description>Numeric port to match</description>
</valueHelp>
<valueHelp>
<format>!u32:1-65535</format>
<description>Numeric port to exclude from matches</description>
</valueHelp>
<valueHelp>
<format>start-end</format>
<description>Numbered port range (e.g. 1001-1005) to match</description>
</valueHelp>
<valueHelp>
<format>!start-end</format>
<description>Numbered port range (e.g. !1001-1005) to exclude from matches</description>
</valueHelp>
<constraint>
<validator name="port-range"/>
<validator name="port-range-exclude"/>
</constraint>
<multi/>
</properties>
</leafNode>
<leafNode name="group">
<properties>
<help>Port group</help>
<completionHelp>
<path>service ids suricata port-group</path>
<list>http-ports shellcode-ports oracle-ports ssh-ports dnp3-ports modbus-ports file-data-ports ftp-ports geneve-ports vxlan-ports teredo-ports</list>
</completionHelp>
<valueHelp>
<format>string</format>
<description>Port group to match</description>
</valueHelp>
<valueHelp>
<format>!string</format>
<description>Exclude the specified port group from matches</description>
</valueHelp>
<constraint>
<regex>!?[a-z0-9-]+</regex>
</constraint>
<multi/>
</properties>
</leafNode>
</children>
</tagNode>
<node name="log">
<properties>
<help>Suricata log outputs</help>
</properties>
<children>
<node name="eve">
<properties>
<help>Extensible Event Format (EVE)</help>
</properties>
<children>
<leafNode name="filetype">
<properties>
<help>EVE logging destination</help>
<completionHelp>
<list>regular syslog</list>
</completionHelp>
<valueHelp>
<format>regular</format>
<description>Log to filename</description>
</valueHelp>
<valueHelp>
<format>syslog</format>
<description>Log to syslog</description>
</valueHelp>
<constraint>
<regex>(regular|syslog)</regex>
</constraint>
</properties>
<defaultValue>regular</defaultValue>
</leafNode>
<leafNode name="filename">
<properties>
<help>Log file</help>
<valueHelp>
<format>filename</format>
<description>File name in default Suricata log directory</description>
</valueHelp>
<valueHelp>
<format>/path</format>
<description>Absolute file path</description>
</valueHelp>
</properties>
<defaultValue>eve.json</defaultValue>
</leafNode>
<leafNode name="type">
<properties>
<help>Log types</help>
<completionHelp>
<list>alert anomaly drop files http dns tls smtp dnp3 ftp rdp nfs smb tftp ikev2 dcerpc krb5 snmp rfb sip dhcp ssh mqtt http2 flow netflow</list>
</completionHelp>
<valueHelp>
<format>alert</format>
<description>Record events for rule matches</description>
</valueHelp>
<valueHelp>
<format>anomaly</format>
<description>Record unexpected conditions such as truncated packets, packets with invalid IP/UDP/TCP length values, and other events that render the packet invalid for further processing or describe unexpected behavior on an established stream</description>
</valueHelp>
<valueHelp>
<format>drop</format>
<description>Record events for dropped packets</description>
</valueHelp>
<valueHelp>
<format>file</format>
<description>Record file details (e.g., MD5) for files extracted from application protocols (e.g., HTTP)</description>
</valueHelp>
<valueHelp>
<format>application (http, dns, tls, ...)</format>
<description>Record application-level transactions</description>
</valueHelp>
<valueHelp>
<format>flow</format>
<description>Record bi-directional flows</description>
</valueHelp>
<valueHelp>
<format>netflow</format>
<description>Record uni-directional flows</description>
</valueHelp>
<constraint>
<regex>(alert|anomaly|http|dns|tls|files|drop|smtp|dnp3|ftp|rdp|nfs|smb|tftp|ikev2|dcerpc|krb5|snmp|rfb|sip|dhcp|ssh|mqtt|http2|flow|netflow)</regex>
</constraint>
<multi/>
</properties>
</leafNode>
</children>
</node>
</children>
</node>
</children>
</node>
</children>
</node>
</children>
</node>
</interfaceDefinition>
|
