From 6c0d365bdb5f4e4fdc2bf57561178573be5a36cc Mon Sep 17 00:00:00 2001
From: bmeeks8 <bmeeks8@bellsouth.net>
Date: Tue, 26 Aug 2014 21:39:21 -0400
Subject: Upgrade Suricata to 2.0.3 and GUI package to v2.0

---
 config/suricata/suricata_yaml_template.inc | 78 ++++++++++++++++++++++++++----
 1 file changed, 68 insertions(+), 10 deletions(-)

(limited to 'config/suricata/suricata_yaml_template.inc')

diff --git a/config/suricata/suricata_yaml_template.inc b/config/suricata/suricata_yaml_template.inc
index 44fd1d5f..e75a1148 100644
--- a/config/suricata/suricata_yaml_template.inc
+++ b/config/suricata/suricata_yaml_template.inc
@@ -15,6 +15,10 @@ max-pending-packets: {$max_pend_pkts}
 # Runmode the engine should use.
 runmode: autofp
 
+# If set to auto, the variable is internally switched to 'router' in IPS 
+# mode and 'sniffer-only' in IDS mode.
+host-mode: auto
+
 # Specifies the kind of flow load balancer used by the flow pinned autofp mode.
 autofp-scheduler: active-packets
 
@@ -55,9 +59,7 @@ outputs:
       enabled: {$http_log_enabled}
       filename: http.log
       append: {$http_log_append}
-      #extended: yes     # enable this for extended logging information
-      #custom: yes       # enabled the custom logging format (defined by customformat)
-      #customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %H %m %h %u %s %B %a:%p -> %A:%P"
+      extended: {$http_log_extended}
       filetype: regular
 
   - pcap-log:
@@ -82,8 +84,8 @@ outputs:
   - syslog:
       enabled: {$alert_syslog}
       identity: suricata
-      facility: auth
-      level: Info
+      facility: {$alert_syslog_facility}
+      level: {$alert_syslog_priority}
 
   - drop:
       enabled: no
@@ -94,8 +96,8 @@ outputs:
   - file-store:
       enabled: {$file_store_enabled}
       log-dir: files
-      force-magic: no
-      force-md5: no
+      force-magic: {$json_log_magic}
+      force-md5: {$json_log_md5}
       waldo: file.waldo
 
   - file-log:
@@ -106,6 +108,21 @@ outputs:
       force-magic: {$json_log_magic}
       force-md5: {$json_log_md5}
 
+  - dns-log:
+      enabled: {$dns_log_enabled}
+      filename: dns.log
+      append: {$dns_log_append}
+      filetype: regular
+
+  - eve-log:
+      enabled: {$enable_eve_log}
+      type: {$eve_output_type}
+      filename: eve.json
+      identity: "suricata"
+      facility: {$eve_systemlog_facility}
+      level: {$eve_systemlog_priority}
+      types: {$eve_out_types}
+
 # Magic file. The extension .mgc is added to the value here.
 magic-file: /usr/share/misc/magic
 
@@ -233,7 +250,7 @@ logging:
       filename: {$suricatalogdir}suricata_{$if_real}{$suricata_uuid}/suricata.log
   - syslog:
       enabled: {$suricata_use_syslog}
-      facility: auth
+      facility: {$suricata_use_syslog_facility}
       format: "[%i] <%d> -- "
 
 pcap:
@@ -276,8 +293,8 @@ action-order:
   - alert
 
 # IP Reputation
-#reputation-categories-file: {$suricatacfgdir}/iprep/categories.txt
-#default-reputation-path: {$suricatacfgdir}/iprep
+#reputation-categories-file: {$iprep_path}/categories.txt
+#default-reputation-path: {$iprep_path}
 #reputation-files:
 # - reputation.list
 
@@ -293,6 +310,47 @@ pcre:
   match-limit: 3500
   match-limit-recursion: 1500
 
+# Holds details on the app-layer. The protocols section details each protocol.
+app-layer:
+  protocols:
+    tls:
+      enabled: {$tls_parser}
+      detection-ports:
+        dp: 443
+      #no-reassemble: yes
+    dcerpc:
+      enabled: {$dcerpc_parser}
+    ftp:
+      enabled: {$ftp_parser}
+    ssh:
+      enabled: {$ssh_parser}
+    smtp:
+      enabled: {$smtp_parser}
+    imap:
+      enabled: {$imap_parser}
+    msn:
+      enabled: {$msn_parser}
+    smb:
+      enabled: {$smb_parser}
+      detection-ports:
+        dp: 139
+    dns:
+      global-memcap: {$dns_global_memcap}
+      state-memcap: {$dns_state_memcap}
+      request-flood: {$dns_request_flood_limit}
+
+      tcp:
+        enabled: {$dns_parser_tcp}
+        detection-ports:
+          dp: 53
+      udp:
+        enabled: {$dns_parser_udp}
+        detection-ports:
+          dp: 53
+    http:
+      enabled: {$http_parser}
+      memcap: {$http_parser_memcap}
+
 ###########################################################################
 # Configure libhtp.
 libhtp:
-- 
cgit v1.2.3