Suricata configuration¶
In addition to downloading Suricata rulesets from multiple sources, Corelight-update can manage the ruleset. It works by optionally applying Corelight recommended changes to the rulesets, and extracting content from Suricata rules and creating Zeek Intel rules with that content.
Content is only extracted from enabled rules and the “do_notice” flag can individually be set based on rule type. This means you can use the typical enable.conf and disable.conf rules to control what data is extracted. See Suricata policy settings for details.
Tip
No configuration is required to include local Suricata rulesets. See Locally managed data sources for details.
Any “.rules” or “.rules.tar.gz” ruleset placed in the global-suricata folder is automatically available to all policies.
Any “.rules” or “.rules.tar.gz” ruleset placed in a local-suricata folder is automatically available to that policy.
Suricata configuration files¶
Suricata uses four configuration files when processing traffic and/or testing rules.
suricata.yaml
classification.config
reference.config
threshold.config
These configuration files can be manually placed in the policy configs folder (/etc/corelight-update/configs/<policy>/
), or the policy can be configured to pull Suricata configuration files from remote sources if desired. See Remote config files.
See Using a proxy with Corelight-update for details about using a proxy to download remote sources.
Optionally, these configuration files can be pushed to the policy in Fleet Manager or directly to a sensor. See Push content settings.
Warning
Suricata configuration files are not pushed to Microsensor.
Disabled rules¶
By default, disabled rules are not written back to the final Suricata ruleset. If desired, disabled rules can be included in the ruleset file by enabling write_disabled_rules: true
in the Suricata policy settings.
Ruleset testing¶
By default, Corelight-update attempts to test the ruleset using Suricata, if it’s available on the host running Corelight-update. If Suricata is not available, Corelight-update logs that it did not test the ruleset and continues.
If the rulesets is tested, and one or more rules fail the test, the details of the failed rules are logged and processing continues. Optionally, Corelight-update can be configured to discard a failed ruleset, after the failed rules have been logged, by setting fail_on_ruleset_error: true
in the Suricata policy settings.
The output of the ruleset tests will be logged to /var/corelight-update/files/<policy_name>/suricata-ruleset-logs/suricata.log
. Here’s an example log output with a few failed rules.
[434184 - Suricata-Main] 2025-02-25 15:40:23 Notice: suricata: This is Suricata version 7.0.6-corelight.1 RELEASE running in SYSTEM mode
[434184 - Suricata-Main] 2025-02-25 15:40:23 Info: cpu: CPUs/cores online: 4
[434184 - Suricata-Main] 2025-02-25 15:40:23 Error: affinity: worker-cpu-set: upper bound (4) of cpu set is too high, only 4 cpu(s)
[434184 - Suricata-Main] 2025-02-25 15:40:23 Info: suricata: Running suricata under test mode
[434184 - Suricata-Main] 2025-02-25 15:40:23 Info: suricata: Setting engine mode to IDS mode by default
[434184 - Suricata-Main] 2025-02-25 15:40:23 Info: exception-policy: master exception-policy set to: ignore
[434184 - Suricata-Main] 2025-02-25 15:40:23 Info: app-layer-htp-mem: HTTP memcap: 3221225472
[434184 - Suricata-Main] 2025-02-25 15:40:23 Info: app-layer-ftp: FTP memcap: 67108864
[434184 - Suricata-Main] 2025-02-25 15:40:23 Info: suricata: Preparing unexpected signal handling
[434184 - Suricata-Main] 2025-02-25 15:40:23 Warning: counters: stats are enabled but no loggers are active
[434184 - Suricata-Main] 2025-02-25 15:40:32 Error: detect-parse: Duplicate signature "alert tls $HOME_NET any -> any any (msg:"ET MALWARE Observed Win32/Lumma Stealer Related Domain (zanymarkedjz .fun in TLS SNI)"; flow:established,to_server; tls.sni; bsize:16; content:"zanymarkedjz.fun"; fast_pattern; nocase; reference:md5,9240ac0921b526c616074afb4b6b70fd; metadata:tls_state TLSEncrypt, created_at 2024_11_11, deployment Perimeter, malware_family Lumma_Stealer, confidence High, signature_severity Critical, updated_at 2024_11_11, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol; classtype:domain-c2; target:src_ip; gid:1; sid:2057377; rev:1;)"
[434184 - Suricata-Main] 2025-02-25 15:40:32 Error: detect: error parsing signature "alert tls $HOME_NET any -> any any (msg:"ET MALWARE Observed Win32/Lumma Stealer Related Domain (zanymarkedjz .fun in TLS SNI)"; flow:established,to_server; tls.sni; bsize:16; content:"zanymarkedjz.fun"; fast_pattern; nocase; reference:md5,9240ac0921b526c616074afb4b6b70fd; metadata:tls_state TLSEncrypt, created_at 2024_11_11, deployment Perimeter, malware_family Lumma_Stealer, confidence High, signature_severity Critical, updated_at 2024_11_11, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol; classtype:domain-c2; target:src_ip; gid:1; sid:2057377; rev:1;)" from file /var/corelight-update/working/defaultPolicy/suricata-output/suricata.rules at line 54181
[434184 - Suricata-Main] 2025-02-25 15:40:44 Warning: detect-classtype: signature sid:8000515 uses unknown classtype: "inappropriate-content", using default priority 3. This message won't be shown again for this classtype
[434184 - Suricata-Main] 2025-02-25 15:40:44 Error: detect-dsize: Parsing '15<>16' failed
[434184 - Suricata-Main] 2025-02-25 15:40:44 Error: detect: error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "CrowdStrike DarkComet Keepalive v2.x-5.0 [CSIT-15055]"; flow: to_server,established; dsize: 15<>16; content: "KEEPALIVE"; pcre: "/KEEPALIVE\d{6,7}/"; reference:url,falcon.crowdstrike.com/intelligence/reports/CSIT-15055; classtype: trojan-activity; gid:1; sid:8000707; rev:20150604;)" from file /var/corelight-update/working/defaultPolicy/suricata-output/suricata.rules at line 116188
[434184 - Suricata-Main] 2025-02-25 15:40:44 Error: detect-parse: rule 8001269 setup buffer file_data but didn't add matches to it
[434184 - Suricata-Main] 2025-02-25 15:40:44 Error: detect: error parsing signature "alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "CrowdStrike COBALT SPIDER JScript COM Scriptlet Download [CSIT-18154]"; flow: established,to_client; content:"script language=\"JScript"; file_data; content: "parseInt"; file_data; content:"1)] ^ "; fast_pattern; file_data; reference:url,falcon.crowdstrike.com/intelligence/reports/CSIT-18154; metadata:service http; classtype:trojan-activity; gid:1; sid:8001269; rev:20181019;)" from file /var/corelight-update/working/defaultPolicy/suricata-output/suricata.rules at line 116746
[434184 - Suricata-Main] 2025-02-25 15:40:44 Info: detect: 1 rule files processed. 79219 rules successfully loaded, 3 rules failed, 0
[434184 - Suricata-Main] 2025-02-25 15:40:44 Error: suricata: Loading signatures failed.
If any of the Suricata configuration files are placed in the policy configuration folder, or pulled from a remote location, they are automatically used when testing the Suricata ruleset.
Tip
It is recommended to use the same version of Suricata for testing that will be used in production. Testing with the Corelight version of Suricata can be accomplished by installing the Corelight Microsensor (without a license) on the same host running Corelight-update.
For debian based installation, Microsensor is automatically installed as a “recommended” package. This can be disabled by adding the --no-install-recommends
when installing Corelight-update.
Corelight-update and Microsensor use the same package repository so the installation only requires a single command. See Micro Sensor Online Installation for details.
See the following sections for more details: