Extend Suricata support #8372
Extend Suricata support #8372
Conversation
src/opnsense/mvc/app/controllers/OPNsense/IDS/forms/generalSettings.xml
Outdated
Show resolved
Hide resolved
| payload-printable: yes | ||
| {% if not helpers.empty('OPNsense.IDS.general.eveLog.alert.payload') %} | ||
| payload: yes # enable dumping payload in Base64 | ||
| payload-buffer-size: 4kb # max size of payload buffer to output in eve-log |
There was a problem hiding this comment.
We should consider whether this default should be override-able.
| - quic: | ||
| # ja4 hashes in quic records will never be logged unless | ||
| # the following is set to on. (Default off) | ||
| ja4: {{ 'on' if helpers.empty('OPNsense.IDS.general.eveLog.tls.custom') or 'ja4' in OPNsense.IDS.general.eveLog.tls.custom else 'off' }} |
There was a problem hiding this comment.
QUIC's JA4 support is enabled if JA4 is enabled for TLS. We should consider whether a standalone setting for QUIC is preferred.
| <advanced>true</advanced> | ||
| </field> | ||
| <field> | ||
| <id>ids.general.eveLog.files.forceMagic</id> |
There was a problem hiding this comment.
There seem to be a lot of checkboxes. Maybe it would make more sense for one multi select option dropdown to save lots of code:
https://github.com/opnsense/plugins/blob/58c646121f2babb6f66ac47e2fb63c869af9924f/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml#L113-L122
There was a problem hiding this comment.
Pushed a new variant using multi-selects; it indeed looks a lot more user-friendly. Would this work for you? If so, I'll update the migration logic.
src/opnsense/mvc/app/controllers/OPNsense/IDS/forms/generalSettings.xml
Outdated
Show resolved
Hide resolved
Extend Suricata support in OPNsense to increase the monitoring capabilities (e.g., integrate with Malcolm)
Features:
Subsequent changes:
ja4).stats.log(stats can be enabled in EVE).