%YAML 1.1
---


# The default order is pass, drop, reject, alert
action-order:
 - pass
 - drop
 - reject
 - alert

# The default logging directory.
default-log-dir: /nsm/sensor_data/idsprod

# Configure the type of alert (and other) logging you would like.
outputs:
 - fast:
    enabled: yes
    filename: fast.log

 - unified-log:
    enabled: no

 - unified-alert:
    enabled: no

 - unified2-alert:
    enabled: no
    filename: snort.out

 - http-log:
    enabled: yes
    filename: http.log
    limit: 8

 - alert-debug:
    enabled: no

 - alert-prelude:
    enabled: no

 - stats:
    enabled: yes
    filename: stats.log
    interval: 60


defrag:
 max-frags: 65535
 prealloc: yes
 timeout: 60


# When run with the option --engine-analysis, the engine will read each of
# the parameters below, and print reports for each of the enabled sections
# and exit.

engine-analysis:
 rules-fast-pattern: yes


# The detection engine builds internal groups of signatures. The engine
# allow us to specify the profile to use for them, to manage memory on an
# efficient way keeping a good performance. For the profile keyword you
# can use the words "low", "medium", "high" or "custom". If you use custom
# make sure to define the values at "- custom-values" as your convenience.
# Usually you would prefer medium/high/low.

detect-engine:
 - profile: medium
 - custom-values:
    toclient_src_groups: 2
    toclient_dst_groups: 2
    toclient_sp_groups: 2
    toclient_dp_groups: 3
    toserver_src_groups: 2
    toserver_dst_groups: 4
    toserver_sp_groups: 2
    toserver_dp_groups: 25
 - sgh-mpm-context: auto
 - inspection-recursion-limit: 3000


# Suricata is multi-threaded. Here the threading can be influenced.

threading:
 set_cpu_affinity: no
 detect_thread_ratio: 1.5


# Select the multi pattern algorithm you want to run for scan/search the
# in the engine. The supported algorithms are b2g, b2gc, b2gm, b3g, wumanber,
# ac and ac-gfbs.

mpm-algo: ac

# The memory settings for hash size of these algorithms can vary from lowest
# (2048) - low (4096) - medium (8192) - high (16384) - higher (32768) - max
# (65536). The bloomfilter sizes of these algorithms can vary from low (512) -
# medium (1024) - high (2048).

pattern-matcher:
 - b2gc:
    search_algo: B2gSearchBNDMq
    hash_size: low
    bf_size: medium
 - b2gm:
    search_algo: B2gSearchBNDMq
    hash_size: low
    bf_size: medium
 - b2g:
    search_algo: B2gSearchBNDMq
    hash_size: low
    bf_size: medium
 - b3g:
    search_algo: B3gSearchBNDMq
    hash_size: low
    bf_size: medium
 - wumanber:
    hash_size: low
    bf_size: medium


# Flow settings:
# By default, the reserved memory (memcap) for flows is 32MB. This is the limit
# for flow allocation inside the engine. You can change this value to allow
# more memory usage for flows.

flow:
 memcap: 33554432
 hash_size: 65536
 prealloc: 10000
 emergency_recovery: 30
 prune_flows: 5


# Specific timeouts for flows. Here you can specify the timeouts that the
# active flows will wait to transit from the current state to another, on each
# protocol. The value of "new" determine the seconds to wait after a hanshake or
# stream startup before the engine free the data of that flow it doesn't
# change the state to established (usually if we don't receive more packets
# of that flow). The value of "established" is the amount of
# seconds that the engine will wait to free the flow if it spend that amount
# without receiving new packets or closing the connection. "closed" is the
# amount of time to wait after a flow is closed (usually zero).

flow-timeouts:

 default:
  new: 30
  established: 300
  closed: 0
  emergency_new: 10
  emergency_established: 100
  emergency_closed: 0
 tcp:
  new: 60
  established: 3600
  closed: 120
  emergency_new: 10
  emergency_established: 300
  emergency_closed: 20
 udp:
  new: 30
  established: 300
  emergency_new: 10
  emergency_established: 100
 icmp:
  new: 30
  established: 300
  emergency_new: 10
  emergency_established: 100


# Stream engine settings. Here the TCP stream tracking and reaasembly
# engine is configured.

stream:
 memcap: 33554432
 checksum_validation: yes
 reassembly:
  memcap: 67108864
  depth: 1048576


# Logging configuration.  This is not about logging IDS alerts, but
# IDS output about what its doing, errors, etc.

logging:
 default-log-level: info
 default-output-filter:
 outputs:
  - console:
     enabled: no
  - file:
     enabled: yes
     filename: /tmp/suricata-prod.log
  - syslog:
     enabled: no
     facility: local5
     format: "[%i] <%d> -- "


# Set the default rule path here to search for the files.
# if not set, it will look at the current working dir

default-rule-path: /data/config/etc/suricata-prod/rules
rule-files:
 - all.rules
classification-file: /data/config/etc/suricata-prod/classification.config
reference-config-file: /data/config/etc/suricata-prod/reference.config


# Holds variables that would be used by the engine.

vars:
 address-groups:
#   HOME_NET: "[172.25.50.0/27]"
#   EXTERNAL_NET: "!$HOME_NET"
   HOME_NET: any
   EXTERNAL_NET: any
   HTTP_SERVERS: "[172.25.50.20]"
   SMTP_SERVERS: "[172.25.50.22]"
   SQL_SERVERS: "$HOME_NET"
   DNS_SERVERS: "[172.25.50.10]"
   TELNET_SERVERS: "$HOME_NET"
   AIM_SERVERS: any

 port-groups:
   HTTP_PORTS: "80"
   SHELLCODE_PORTS: "!$HTTP_PORTS"
   ORACLE_PORTS: "1521"
   SSH_PORTS: "22"


# Host specific policies for defragmentation and TCP stream
# reassembly.

host-os-policy:
 windows: []
 bsd: []
 bsd_right: []
 old_linux: []
 linux: [172.25.50.0/27]
 old_solaris: []
 solaris: ["::1"]
 hpux10: []
 hpux11: []
 irix: []
 macos: []
 vista: []
 windows2k3: []


# Limit for the maximum number of asn1 frames to decode (default 256)

asn1_max_frames: 256


# Configure libhtp.

libhtp:
 default-config:
   personality: IDS
   request-body-limit: 3072
 server-config:
   - apache:
       address: [172.25.50.20]
       personality: Apache_2_2
       request-body-limit: 4096


# rule profiling settings. Only effective if Suricata has been built with the
# the --enable-profiling configure flag.

profiling:
 rules:
    enabled: yes
    sort: avgticks
    limit: 100
