Integrate Suricata

You can integrate Suricata with Sophos XDR so that it sends data to Sophos for analysis. The integration uses a data collector, which receives third-party data and sends it to the Sophos Data Lake.

Key steps

The key steps in a Suricata integration are as follows:

Install and configure a data collector if you haven't already done so.
Configure syslog-ng to forward Suricata logs.
Configure Suricata to send data to the data collector.

Requirements

The following is required for Suricata configuration:

Suricata 5.0.x installed and running.
Syslog-ng installed and running.
Check the requirements for the data collector you're using by reviewing the guides at Data collectors.

Add a Suricata integration

To integrate Suricata, you must first install a Sophos XDR data collector, then configure Suricata to send logs to it.

Install and configure a data collector

Suricata must be configured to send logs to the Sophos XDR data collector. Logs are filtered and correlated in real-time for various security event observations. Go to Data collectors and follow the guide for creating a data collector if you haven't already done so.

When the data collector is ready, you can configure Suricata to send us data.

Configure syslog-ng on Suricata

Use this sample syslog-ng.conf file to configure syslog-ng on the Suricata sensor to read Suricata's eve.json log file and forward it to the Sophos XDR data collector:

@version:3.19

source s_suricata {
    file("/var/log/suricata/eve.json" # '/var/log/suricata/' is what is defined in your suricata.yaml's default-log-dir setting.
        flags(no-parse)
        );
        };

destination d_collector_tcp {
    tcp("192.168.1.45" port(601)); # 192.168.1.45 is the data collector IP
    };

log {    source(s_suricata);
    destination(d_collector_tcp);
};

Configure logging and turn on monitoring

To set up event forwarding via syslog for Suricata, do as follows:

Follow the steps in Suricata's own guide: Suricata User Guide.
Edit your suricata.yaml file and add the following to the end of your configuration:
```
include: sophos-suricata.yaml
```

Use this template to create your sophos-suricata.yml file:

// sophos-suricata.yaml
%YAML 1.1
---
# Sophos Suricata Configuration for 5.0.2 in eve format.

outputs:
    - eve-log:
        enabled: yes
        #XXX: SOPHOS: Prefix required.
        prefix: "SophosSuricataConfiguration_v5.0.2 @cee: "
        json:
            escape-slash: no
            compact: yes
            preserve-order: yes
        community-id: true #XXX: SOPHOS: Enabled for context
        # Seed value for the ID output. Valid values are 0-65535.
        community-id-seed: 0

        xff:
            enabled: yes #XXX: SOPHOS: Enabled for context.
            mode: extra-data
            deployment: reverse #XXX: SOPHOS: Client can change if needed.
            header: X-Forwarded-For #XXX: SOPHOS: Client can change if needed.

        types:
            - alert:
                payload: yes #XXX: SOPHOS: Added context for Nids pcap.
                packet: yes #XXX: SOPHOS: Added context for Nids pcap.
            - anomaly:
                enabled: yes #XXX: SOPHOS: Keep defaults
                type:
                    #decode: no
                    #stream: no
                    #applayer: yes
                    #packethdr: no
            - http:
                extended: yes
            - dns:
                enabled: yes
                version: 2 # #XXX: SOPHOS: version 1 will be ignored.
            - tls:
                extended: yes
            - files: # XXX: SOPHOS: sparse data type.
                enabled: no
            - drop:
                alerts: yes
                flows: all
            - smtp:
                extended: yes
            - dhcp:
                enabled: yes
                extended: no

            - ftp
            #- rdp # XXX: SOPHOS: off by default
            - nfs
            - smb
            - tftp
            - ikev2
            - krb5
            - snmp
            #- sip # XXX: SOPHOS: off by default
            - ssh
            - flow

# Used for local testing

# rule-files:

#    - suricata.rules

#    - local.rules

For more information about the EVE JSON file, see Eve JSON Output.

Place sophos-suricata.yaml in the same directory as suricata.yaml.
Review the changes that sophos-suricata.yaml will overwrite, and adjust if needed.

For example, if your environment uses a different field than X-Forwarded-For, configure xff to use the right header and type (reverse vs. forward).

Run suricata -T -c /path/of/suricata/yaml/suricata.yaml to validate that the suricata.yaml and sophos-suricata.yaml configurations are valid.

This is a sample output:

root@0b8f0596b1ac:/# suricata -T -c /etc/suricata/suricata.yaml
[120] 28/2/2020 -- 21:13:35 - (suricata.c:1905) <Info> (ParseCommandLine) -- Running suricata under test mode
[120] 28/2/2020 -- 21:13:35 - (conf-yaml-loader.c:255) <Info> (ConfYamlParse) -- Including configuration file sophos-suricata.yaml.
[120] 28/2/2020 -- 21:13:35 - (conf-yaml-loader.c:279) <Info> (ConfYamlParse) -- Configuration node 'outputs' redefined.
[120] 28/2/2020 -- 21:13:35 - (conf-yaml-loader.c:279) <Info> (ConfYamlParse) -- Configuration node 'rule-files' redefined.
[120] 28/2/2020 -- 21:13:35 - (suricata.c:1084) <Notice> (LogVersion) -- This is Suricata version 5.0.2 RELEASE running in SYSTEM mode
[120] 28/2/2020 -- 21:13:35 - (counters.c:297) <Warning> (StatsInitCtxPostOutput) -- [ERRCODE: SC_WARN_NO_STATS_LOGGERS(261)] - stats are enabled but no loggers are active
[120] 28/2/2020 -- 21:13:42 - (suricata.c:3060) <Notice> (main) -- Configuration provided was successfully loaded. Exiting.

Your Suricata data should now appear in the Sophos Data Lake after validation.