[Oisf-users] threshold.conf with rate_limit or drop rules

[Peter Manev]

On Wed, Sep 13, 2017 at 9:53 PM, Jeff Dyke <jeff.dyke at gmail.com> wrote:
> i am running an array of servers on aws (EC2 instances), one server in both
> the staging and production environments has SSH open and 2 have 443/80 open
> (active/passive HAProxy instances)
>
> I've been using OSSEC with active-response to block malicious ssh attacks,
> and while i like the software and the other things that it finds, I would
> like to move this type of logic to the edge servers, using suricata.  i'll
> concentrate on SSH for now, from there i can apply my knowledge or other
> protocols.
>
> If i'm understanding correctly (likely not) i could add a rate_filter into
> threshold.conf, or i could add drop rules.  What is the best practice in
> this instance.  I know the threshold.config is getting parsed as i see the
> warning
> [ERRCODE: SC_ERR_EVENT_ENGINE(210)] - signature sid:2019876 has a threshold
> set. The signature event var is given precedence over the threshold.conf
> one. Bug #425.
>
> I'm running suricata 4.0.0 RELEASE
>
> Thanks, for any pointers.  If rate_filter is correct, how do i convert it to
> a drop event when threshold is hit?  The docs are great, but i seemed to
> have missed this piece.
>
> Jeff
>
> my 4 threshold.config entries.
> rate_filter gen_id 1, sig_id 2019876, track by_rule, count 3, seconds 120,
> new_action drop, timeout 14400
> rate_filter gen_id 1, sig_id 2101638, track by_rule, count 3, seconds 120,
> new_action drop, timeout 14400
> rate_filter gen_id 1, sig_id 2001219, track by_rule, count 3, seconds 120,
> new_action drop, timeout 14400
> rate_filter gen_id 1, sig_id 2006546, track by_rule, count 3, seconds 120,
> new_action drop, timeout 14400
> suppress gen_id 1, sig_id 2221002, track by_src, ip 10.0.0.0/16
>

I dont think rate_filter are fully implement yet  for threshold.conf.



-- 
Regards,
Peter Manev