NAME

suricata_extract_submit - Submits files extracted by Suricata to mojo_cape_submit for detonation via CAPEv2

VERSION

1.0.0

SYNOPSIS

suricata_extract_submit

*/5 * * * * /usr/local/bin/suricata_extract_submit 2> /dev/null > /dev/null

DESCRIPTION

What is printed to standard out is also sent to syslog.

This requires having the file-store output configured akin to below.

- file-store:
    version: 2
    enabled: yes
    dir: /var/log/suricata/files
    write-fileinfo: yes
    stream-depth: 0
    force-hash: [sha1, md5]
    xff:
      enabled: no
      mode: extra-data
      deployment: reverse
      header: X-Forwarded-For

The force-hash values are optional as this script will automatically compute those for inclusion as well SHA256.

This will use `/var/run/suricata_extract_submit.pid` as a PID file to ensure only a single instance is running.

May be checked to see if it has hung like below. Below will alert if a PID file with a M time of older than 5 minutes.

/usr/local/libexec/nagios/check_file_age -i -f /var/run/suricata_extract_submit.pid

Safe to dump the output of this to dev null in cron as the output is also sent to syslog as 'suricata_extract_submit' to the 'daemon' log.

CONFIGURATION

The config file used is '/usr/local/etc/suricata_extract_submit.ini'.

# the API key to use if needed
#apikey=

# URL to find mojo_cape_submit at
url=http://192.168.14.15:8080/

# the group/client/whathaveya slug
slug=foo

# where Suricata has the file store at
filestore=/var/log/suricata/files

# a file of IPs or subnets to ignore SRC or DEST IPs of
#ignore=

# a file of regex to use for checking host names to ignore
#ignoreHosts=

# a file of regex to use for checking host names to ignore
#ignoreHosts=

# a file of regex to use for checking user agents to ignore
#ignoreUAs=

# a file of regex to use for checking path chunks of the URL to ignore
#ignorePaths=

# a file of regex to use for checking path chunks of the URL to ignore
ignoreMaxSize=52428800

# a JSON file to use for using with Web::ACL for checking for ignores
#ignoreWebACL=/usr/local/etc/suricata_extract_submit_webacl.json

# if it should use HTTPS_PROXY and HTTP_PROXY from ENV or not
env_proxy=0

# stats file holding only the stats for the last run
stats_file=/var/cache/suricata_extract_submit_stats.json

# stats dir
stats_dir=/var/cache/suricata_extract_submit_stats/

example Web::ACL

A example Web::ACL that ignores UAs matching "foo bar" and paths matching "/derp.exe".

{
  "foo": {
    "ua_auth": 1,
    "path_auth": 1,
    "ua_regex_allow": [
      "^foo bar$"
    ],
    "paths_regex_allow": [
      "^\\/derp.exe$"
    ],
    "final": 1
  }
}

Each key will be tests twice. First with the IP set to the src IP and then set to the client IP. The var mapping is as below.

.http.http_user_agent -> ua
.fileinfo.filename -> path

.dest_ip -> ip
.src_ip -> ip