Configuration settings

General settings

Additional logging options

If additional logging detail is needed, enable verbose logging. This setting is in addition to the CLI debugging option.

verbose: false

Experimental features

There are currently no experimental features available in Corelight-update.

exp_features: false

Auto-updating policy settings

You can configure Corelight-update to automatically update a policy using a pre-selected configuration file name, and directory path. When auto_updating_policies is enabled, Corelight-update monitors the directory path /etc/corelight-update/configs/<policy_name>/ for a file as defined in filename.

On each service interval, Corelight-update checks each path for a policy configuration file, and applies that configuration to the policy. This setting is enabled by default.

auto_update_policies:
  enable:   true
  filename: db-config.yaml

Note

When auto_updating_policies is enabled, a configuration file matching the filename setting is required in each policy directory: /etc/corelight-update/configs/<policy_name>/

Pushing content to sensors in parallel

By default, Corelight-update will deploy content updates to the sensors concurrently. Corelight-update will open a connection to multiple sensors in a policy, push updated content, and cycle to the next sensor, up to the parallel_push_limit setting.

Content updates are performed in a specified order. To review the order of operations, see Push content for policies. The default for parallel_push_limit is 10 sensors.

parallel_push_limit: 10

Global-level data sources

Corelight-update supports applying a limited selection of data sources at the Global level.

GeoIP database

Enables downloading of the Maxmind GeoIP database. The default interval is 1 week.

geoip:
  enable_maxmind: false
  interval_hours: 168
  account_id: 0
  license_key: ""
  database_directory: "/var/corelight-update/files/all/geoip"

For additional details, see Maxmind GeoIP.

Remote data sources

Remote sources are required to be added to each policy configuration. However, any source that’s cached globally, will only be downloaded once. See Remote source settings for details.

Locally managed data sources

In addition to downloading content from external sources for your sensors, Corelight-update will also accept locally-sourced content and configurations that can be applied at a Global-level, or at a Policy-level.

Corelight-update provides folders for input, threat intel, and suricata data at the Global-level and Policy-level, where you can place pre-formatted content to be processed. The following is a list of folder locations files can be placed for automatic processing.

/etc/corelight-update/global/global-input
/etc/corelight-update/global/global-intel
/etc/corelight-update/global/global-suricata
/etc/corelight-update/configs/<policy_name>/local-input
/etc/corelight-update/configs/<policy_name>/local-intel
/etc/corelight-update/configs/<policy_name>/local-suricata

For example, if an intel file is placed in the global-intel folder, the contents are added to the published intel file for all policies. If an intel file is placed in a policy local-intel folder, the contents are automatically added to the published intel file only for that policy.

The following functions do not require any additional configuration:

Local Intel folders

  • All Zeek compatible formatted files in the global-intel folder are added to all policies as an intel file.

  • Any Zeek compatible formatted files placed in a local-intel folder is added to that policy as an intel file.

  • Any intel files in the global-intel, local-intel, or generated by an enabled integration are automatically merged into a single intel.dat file.

Local Suricata folders

  • Any Suricata formatted “.rules” or “.rules.tar.gz” ruleset files placed in the global-suricata folder are available to all policies.

  • Any Suricata formatted “.rules” or “.rules.tar.gz” ruleset placed in a local-suricata folder are available to that policy.

  • Any ruleset file in the global-suricata, local-suricata, or generated by an enabled integration are automatically processed and merged into a single suricata.rules file.

Local Input folders

  • Any Zeek compatible formatted files placed in the global-input folder are available to all policies.

  • Any Zeek compatible formatted files placed in a local-input folder are available to that policy.

  • Any input files in the global-input, local-input, or generated by an enabled integration, (with the same name) will automatically get merged into a single input file with that name.

To review the order that the configurations are processed in, see Order of operations.

Global-level Suricata settings

If you maintain a centralized set of Suricata configuration files for ruleset tuning and management, you can configure Corelight-update to automatically download your Suricata configuration files from a remote source, and apply them to the Corelight-update connected sensors.

The Suricata configuration files disable.conf, enable.conf and modify.conf can be applied at a global level, and at a policy level. If a disable.conf, enable.conf or modify.conf exist in the Global config directory, they will be processed for each policy automatically.

Each time the Corelight-update service runs, the Suricata rulesets can be processed up to three times for each policy:

  1. Process any enabled Corelight recommended configs,

  2. Process any enabled global-level configs,

  3. Process the Suricata policy-level configs.

For example, to pull a modify.conf file from GitHub and apply it as part of your Global policy:

     remote_global_conf_files:
      - name: modify.conf
        url: https://raw.githubusercontent.com/fakeuser/conf/main/modify.conf
        auth_type: basic
        username: fakeuser
        encrypted_pass: 8946af417b8c3a13358ac42e6f6fbb3f256e2f5cc778a08...

The supported authentication types are no auth, basic, or token. When using the no auth option, leave the auth_type field empty.

See Using a proxy with Corelight-update for details about using a proxy to download remote sources.

Updating the Global configuration

Changes can be made to the global policy using either:

  • A config file.

  • The Corelight-update CLI command by using the --global-settings switch.

After updating a configuration, we recommended verifying the global configuration on the console. For example:

 corelight-update show -global

Complete global settings

verbose: false
exp_features: false
webserver:
    enable: true
    tls: true
    tls_cert: /etc/corelight-update/global/cert.crt
    tls_key: /etc/corelight-update/global/cert.key
    port: 8443
process_feeds: true
interval_minutes: 60
geoip:
    enabled: false
    interval_hours: 168
    account_id: 0
    license_key: ""
    database_directory: /var/corelight-update/files/all/geoip
remote_global_conf_files:
    - name:
      url:
      auth_type:
      auth_token:
      auth_token_header:
      username:
      encrypted_pass:
      ignore_tls:
parallel_push_limit: 10
auto_update_policies:
    enable: true
    filename: db-config.yaml