%YAML 1.1
---

# If you are using the CUDA pattern matcher (b2g_cuda below), different rules
# apply. In that case try something like 4000 or more. This is because the CUDA
# pattern matcher scans many packets in parallel.
#max-pending-packets: 50



# Runmode custom mode the engine should run in.  Please check --list-runmodes
# to get the runmode custom modes that can be used here for a particular runmode.
#runmode: auto



# Preallocated size for packet. Default is 1514 which is the classical
# size for pcap on ethernet. You should adjust this value to the highest
# packet size (MTU + hardware header) on your system.
#default-packet-size: 1514



# Set the order of alerts bassed on actions
# The default order is pass, drop, reject, alert
action-order:
  - pass
  - drop
  - reject
  - alert



# The default logging directory.  Any log or output file will be
# placed here if its not specified with a full path name.  This can be
# overridden with the -l command line parameter.
default-log-dir: /nsm/sguil_sensor/idpesx02

# Configure the type of alert (and other) logging you would like.
outputs:

  - fast:
     enabled: yes
     filename: idpesx02.alerts
     append: yes

  - unified2-alert:
     enabled: yes
     filename: suricata.out
     limit: 128

  - http-log:
     enabled: no
     filename: http.log
     append: yes

  - pcap-info:
     enabled: no

  - pcap-log:
     enabled: yes
     filename: suricata.log
     limit: 1000
     max_files: 100
     mode: sguil
     dir: /nsm/sguil_sensor/idpesx02/dailylogs
     use_stream_depth: no

  - alert-debug:
     enabled: no

  - alert-prelude:
     enabled: no

  - stats:
     enabled: yes
     filename: suricata.stats
     interval: 60

  - syslog:
     enabled: no

  - drop:
     enabled: yes
     filename: drop.log
     append: yes



defrag:
  max-frags: 65535
  prealloc: yes
  timeout: 60



engine-analysis:
  rules-fast-pattern: yes



pcre:
  match-limit: 3500
  match-limit-recursion: 1500



# You can specify a threshold config file by setting "threshold-file"
# to the path of the threshold config file:
threshold-file: /data/config/etc/suricata/threshold.config



detect-engine:
  - profile: medium
  - custom-values:
     toclient_src_groups: 2
     toclient_dst_groups: 2
     toclient_sp_groups: 2
     toclient_dp_groups: 3
     toserver_src_groups: 2
     toserver_dst_groups: 4
     toserver_sp_groups: 2
     toserver_dp_groups: 25
  - sgh-mpm-context: auto
  - inspection-recursion-limit: 3000



threading:
  set_cpu_affinity: no
  detect_thread_ratio: 1.5



mpm-algo: ac



pattern-matcher:
  - b2gc:
     search_algo: B2gSearchBNDMq
     hash_size: low
     bf_size: medium
  - b2gm:
     search_algo: B2gSearchBNDMq
     hash_size: low
     bf_size: medium
  - b2g:
     search_algo: B2gSearchBNDMq
     hash_size: low
     bf_size: medium
  - b3g:
     search_algo: B3gSearchBNDMq
     hash_size: low
     bf_size: medium
  - wumanber:
     hash_size: low
     bf_size: medium



flow:
  memcap: 33554432
  hash_size: 65536
  prealloc: 10000
  emergency_recovery: 30
  prune_flows: 5



flow-timeouts:
  default:
     new: 30
     established: 300
     closed: 0
     emergency_new: 10
     emergency_established: 100
     emergency_closed: 0
  tcp:
     new: 60
     established: 3600
     closed: 120
     emergency_new: 10
     emergency_established: 300
     emergency_closed: 20
  udp:
     new: 30
     established: 300
     emergency_new: 10
     emergency_established: 100
  icmp:
     new: 30
     established: 300
     emergency_new: 10
     emergency_established: 100



stream:
  memcap: 33554432
  checksum_validation: yes
  inline: yes
  reassembly:
    memcap: 67108864
    depth: 1048576
    toserver_chunk_size: 2560
    toclient_chunk_size: 2560



logging:
  default-log-level: info
  default-output-filter:
     outputs:
       - console:
           enabled: no
       - file:
           enabled: no
           filename: /var/log/suricata.log
       - syslog:
           enabled: no
           facility: local5
           format: "[%i] <%d> -- "



pcap:
  - interface: eth8



classification-file: /data/config/etc/suricata/classification.config
reference-config-file: /data/config/etc/suricata/reference.config
default-rule-path: /data/config/etc/suricata/rules/
rule-files:
  - botcc.rules
  - ciarmy.rules
  - compromised.rules
  - dshield.rules
  - emerging-attack_response.rules
  - emerging-exploit.rules
  - emerging-malware.rules
  - emerging-policy.rules
  - emerging-shellcode.rules
  - emerging-web_client.rules
  - rbn-malvertisers.rules
  - rbn.rules
  - tor.rules 



vars:
  address-groups:
     HOME_NET: "[172.25.50.0/27]"
     EXTERNAL_NET: "!$HOME_NET"
     HTTP_SERVERS: "$HOME_NET"
     SMTP_SERVERS: "$HOME_NET"
     SQL_SERVERS: "$HOME_NET"
     DNS_SERVERS: "$HOME_NET"
     TELNET_SERVERS: "$HOME_NET"
     AIM_SERVERS: "$EXTERNAL_NET"

  port-groups:
     HTTP_PORTS: "80"
     SHELLCODE_PORTS: "!80"
     ORACLE_PORTS: 1521
     SSH_PORTS: 22



host-os-policy:
  windows: [0.0.0.0/0]
  bsd: []
  bsd_right: []
  old_linux: []
  linux: [10.0.0.0/8, 192.168.1.100, "8762:2352:6241:7245:E000:0000:0000:0000"]
  old_solaris: []
  solaris: ["::1"]
  hpux10: []
  hpux11: []
  irix: []
  macos: []
  vista: []
  windows2k3: []



asn1_max_frames: 256



libhtp:
  default-config:
     personality: IDS
     request_body_limit: 3072

  server-config:
     - apache:
         address: [192.168.1.0/24, 127.0.0.0/8, "::1"]
         personality: Apache_2_2
         request_body_limit: 4096
     - iis7:
         address: [192.168.0.0/24, 192.168.10.0/24]
         personality: IIS_7_0
         request_body_limit: 4096



profiling:
  rules:
     enabled: yes
     filename: rule_perf.log
     append: yes
     sort: avgticks
     limit: 100

  packets:
     enabled: yes
     filename: packet_stats.log
     append: yes
     csv:
       enabled: no
       filename: packet_stats.csv
