Integrate Suricata

You can integrate Suricata with Sophos XDR so that it sends data to Sophos for analysis. The integration uses a data collector, which receives third-party data and sends it to the Sophos Data Lake.

Key steps

The key steps in a Suricata integration are as follows:

Install and configure a data collector if you haven't already done so.
Configure syslog-ng to forward Suricata logs.
Configure Suricata to send data to the data collector.

Requirements

The following is required for Suricata configuration:

Suricata 5.0.x installed and running.
Syslog-ng installed and running.
Check the requirements for the data collector you're using by reviewing the guides at Data collectors.

Add a Suricata integration

To integrate Suricata, you must first install a Sophos XDR data collector, then configure Suricata to send logs to it.

Install and configure a data collector

Suricata must be configured to send logs to the Sophos XDR data collector. Logs are filtered and correlated in real-time for various security event observations. Go to Data collectors and follow the guide for creating a data collector if you haven't already done so.

When the data collector is ready, you can configure Suricata to send us data.

Configure syslog-ng on Suricata

Use this sample syslog-ng.conf file to configure syslog-ng on the Suricata sensor to read Suricata's eve.json log file and forward it to the Sophos XDR data collector:

@version:3.19

source s_suricata {
    file("/var/log/suricata/eve.json" # '/var/log/suricata/' is what is defined in your suricata.yaml's default-log-dir setting.
        flags(no-parse)
        );
        };

destination d_collector_tcp {
    tcp("192.168.1.45" port(601)); # 192.168.1.45 is the data collector IP
    };

log {    source(s_suricata);
    destination(d_collector_tcp);
};

Configure logging and enable monitoring

To set up event forwarding via syslog for Suricata, do as follows:

Follow the steps in Suricata's own guide: Suricata User Guide.
Edit your suricata.yaml file and add the following to the end of your configuration:
```
include: sophos-suricata.yaml
```

Use this template to create your sophos-suricata.yml file:

// sophos-suricata.yaml
%YAML 1.1
---
# Sophos Suricata Configuration for 5.0.2 in eve format.

outputs:
    - eve-log:
        enabled: yes
        #XXX: SOPHOS: Prefix required.
        prefix: "SophosSuricataConfiguration_v5.0.2 @cee: "
        json:
            escape-slash: no
            compact: yes
            preserve-order: yes
        community-id: true #XXX: SOPHOS: Enabled for context
        # Seed value for the ID output. Valid values are 0-65535.
        community-id-seed: 0

        xff:
            enabled: yes #XXX: SOPHOS: Enabled for context.
            mode: extra-data
            deployment: reverse #XXX: SOPHOS: Client can change if needed.
            header: X-Forwarded-For #XXX: SOPHOS: Client can change if needed.

        types:
            - alert:
                payload: yes #XXX: SOPHOS: Added context for Nids pcap.
                packet: yes #XXX: SOPHOS: Added context for Nids pcap.
            - anomaly:
                enabled: yes #XXX: SOPHOS: Keep defaults
                type:
                    #decode: no
                    #stream: no
                    #applayer: yes
                    #packethdr: no
            - http:
                extended: yes
            - dns:
                enabled: yes
                version: 2 # #XXX: SOPHOS: version 1 will be ignored.
            - tls:
                extended: yes
            - files: # XXX: SOPHOS: sparse data type.
                enabled: no
            - drop:
                alerts: yes
                flows: all
            - smtp:
                extended: yes
            - dhcp:
                enabled: yes
                extended: no

            - ftp
            #- rdp # XXX: SOPHOS: off by default
            - nfs
            - smb
            - tftp
            - ikev2
            - krb5
            - snmp
            #- sip # XXX: SOPHOS: off by default
            - ssh
            - flow

# Used for local testing

# rule-files:

#    - suricata.rules

#    - local.rules

For more information about the EVE JSON file, see Eve JSON Output.

Place sophos-suricata.yaml in the same directory as suricata.yaml.
Review the changes that sophos-suricata.yaml will overwrite, and adjust if needed.

For example, if your environment uses a different field than X-Forwarded-For, configure xff to use the right header and type (reverse vs. forward).

Run suricata -T -c /path/of/suricata/yaml/suricata.yaml to validate that the suricata.yaml and sophos-suricata.yaml configurations are valid.

This is a sample output:

root@0b8f0596b1ac:/# suricata -T -c /etc/suricata/suricata.yaml
[120] 28/2/2020 -- 21:13:35 - (suricata.c:1905) <Info> (ParseCommandLine) -- Running suricata under test mode
[120] 28/2/2020 -- 21:13:35 - (conf-yaml-loader.c:255) <Info> (ConfYamlParse) -- Including configuration file sophos-suricata.yaml.
[120] 28/2/2020 -- 21:13:35 - (conf-yaml-loader.c:279) <Info> (ConfYamlParse) -- Configuration node 'outputs' redefined.
[120] 28/2/2020 -- 21:13:35 - (conf-yaml-loader.c:279) <Info> (ConfYamlParse) -- Configuration node 'rule-files' redefined.
[120] 28/2/2020 -- 21:13:35 - (suricata.c:1084) <Notice> (LogVersion) -- This is Suricata version 5.0.2 RELEASE running in SYSTEM mode
[120] 28/2/2020 -- 21:13:35 - (counters.c:297) <Warning> (StatsInitCtxPostOutput) -- [ERRCODE: SC_WARN_NO_STATS_LOGGERS(261)] - stats are enabled but no loggers are active
[120] 28/2/2020 -- 21:13:42 - (suricata.c:3060) <Notice> (main) -- Configuration provided was successfully loaded. Exiting.

Your Suricata data should now appear in the Sophos Data Lake after validation.

Configuration notes

Keep the following in mind during Suricata configuration:

You can configure multiple instances of Suricata to send data to Sophos via the same data collector. After you finish integration, repeat the steps in this section for your other instances of Suricata.

Additional resources

For more information on configuring Suricata, see the following documents: