Browse Source
Resolve "Adding Suricata" Closes #135 See merge request cyber5k/mistborn!82merge-requests/83/merge
Steven Foerster
5 years ago
6 changed files with 158 additions and 0 deletions
@ -0,0 +1,129 @@
@@ -0,0 +1,129 @@
|
||||
#!/bin/bash |
||||
|
||||
set -e |
||||
|
||||
# detect if suricata is installed |
||||
if [[ $(dpkg-query -W -f='${Status}' suricata 2>/dev/null | grep -c "ok installed") -eq 1 ]]; then |
||||
echo "Suricata Installed" |
||||
exit 0 |
||||
fi |
||||
|
||||
source /opt/mistborn/scripts/subinstallers/platform.sh |
||||
|
||||
# minimal dependencies |
||||
sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev \ |
||||
libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \ |
||||
make libmagic-dev libjansson-dev jq wget |
||||
|
||||
## recommended dependencies |
||||
#sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev \ |
||||
# libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \ |
||||
# libcap-ng-dev libcap-ng0 make libmagic-dev \ |
||||
# libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \ |
||||
# python-yaml rustc cargo |
||||
|
||||
# iptables/nftables integration |
||||
sudo -E apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 \ |
||||
libnetfilter-log-dev libnetfilter-log1 \ |
||||
libnfnetlink-dev libnfnetlink0 |
||||
|
||||
|
||||
if [ "$DISTRO" == "ubuntu" ]; then |
||||
echo "Installing Suricata Ubuntu PPA" |
||||
sudo -E add-apt-repository -y ppa:oisf/suricata-stable |
||||
sudo -E apt-get update |
||||
sudo -E apt-get install -y suricata |
||||
elif [ "$DISTRO" == "debian" ]; then |
||||
# retrieve version codename |
||||
source /etc/os-release |
||||
echo "deb http://http.debian.net/debian $VERSION_CODENAME-backports main" | \ |
||||
sudo -E tee /etc/apt/sources.list.d/backports.list |
||||
sudo -E apt-get update |
||||
sudo -E apt-get install -y suricata -t ${VERSION_CODENAME}-backports |
||||
else |
||||
echo "Basic Suricata installation" |
||||
sudo -E apt-get install -y suricata |
||||
fi |
||||
|
||||
# # iptables |
||||
# sudo iptables -A INPUT -j NFQUEUE |
||||
# sudo iptables -I FORWARD -j NFQUEUE |
||||
# sudo iptables -I OUTPUT -j NFQUEUE |
||||
|
||||
# # rsyslog to create /var/log/suricata.log |
||||
# sudo cp ./scripts/conf/20-suricata.conf /etc/rsyslog.d/ |
||||
# sudo chown root:root /etc/rsyslog.d/20-suricata.conf |
||||
# sudo systemctl restart rsyslog |
||||
|
||||
# rules |
||||
pushd . |
||||
cd /tmp |
||||
wget https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz |
||||
tar zxvf emerging.rules.tar.gz |
||||
sudo -E rm /etc/suricata/rules/* -f |
||||
sudo -E mv rules/*.rules /etc/suricata/rules/ |
||||
popd |
||||
|
||||
# suricata yaml |
||||
sudo -E rm -f /etc/suricata/suricata.yaml |
||||
sudo -E wget -O /etc/suricata/suricata.yaml http://www.branchnetconsulting.com/wazuh/suricata.yaml |
||||
|
||||
IFACE=$(ip -o -4 route show to default | awk 'NR==1{print $5}') |
||||
sudo sed -i "s/eth0/${IFACE}/g" /etc/suricata/suricata.yaml |
||||
sudo sed -i "s/eth0/${IFACE}/g" /etc/default/suricata |
||||
|
||||
#systemctl restart suricata |
||||
|
||||
# wait for service to be listening |
||||
while ! nc -z 10.2.3.1 55000; do |
||||
WAIT_TIME=10 |
||||
echo "Waiting ${WAIT_TIME} seconds for Wazuh API..." |
||||
sleep ${WAIT_TIME} |
||||
done |
||||
|
||||
# set working directory to mistborn for docker-compose |
||||
pushd . |
||||
cd /opt/mistborn |
||||
|
||||
# ensure group exists |
||||
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -g suricata -q 2>/dev/null |
||||
|
||||
# add this host to group |
||||
WAZUH_ID=$(sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/manage_agents -l | egrep ^\ *ID | grep $(hostname) | awk '{print $2}' | tr -d ',') |
||||
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -i ${WAZUH_ID} -g suricata -q |
||||
|
||||
# write agent.conf |
||||
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh bash -c "cat > /var/ossec/etc/shared/suricata/agent.conf << EOF |
||||
<agent_config> |
||||
<localfile> |
||||
<log_format>json</log_format> |
||||
<location>/var/log/suricata/eve.json</location> |
||||
</localfile> |
||||
</agent_config> |
||||
EOF |
||||
" |
||||
|
||||
# restart manager |
||||
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml restart wazuh |
||||
|
||||
popd |
||||
|
||||
# suricata-update |
||||
sudo -E apt install python3-pip |
||||
sudo -E pip3 install pyyaml |
||||
sudo -E pip3 install https://github.com/OISF/suricata-update/archive/master.zip |
||||
|
||||
sudo -E pip3 install --pre --upgrade suricata-update |
||||
|
||||
# sudo -E suricata-update enable-source oisf/trafficid |
||||
# sudo -E suricata-update enable-source etnetera/aggressive |
||||
# sudo -E suricata-update enable-source sslbl/ssl-fp-blacklist |
||||
# sudo -E suricata-update enable-source et/open |
||||
# sudo -E suricata-update enable-source tgreen/hunting |
||||
# sudo -E suricata-update enable-source sslbl/ja3-fingerprints |
||||
# sudo -E suricata-update enable-source ptresearch/attackdetection |
||||
|
||||
sudo -E suricata-update |
||||
|
||||
sudo systemctl daemon-reload |
||||
sudo systemctl restart suricata |
||||
@ -0,0 +1,7 @@
@@ -0,0 +1,7 @@
|
||||
#!/bin/bash |
||||
|
||||
systemctl start suricata |
||||
systemctl enable suricata |
||||
|
||||
#apt-get install -y python-pyinotify |
||||
#python /opt/mistborn/scripts/services/scirius/suri_reloader -p /etc/suricata/rules & |
||||
@ -0,0 +1,6 @@
@@ -0,0 +1,6 @@
|
||||
#!/bin/bash |
||||
|
||||
systemctl stop suricata |
||||
systemctl disable suricata |
||||
|
||||
#kill $(pgrep -f suri_reloader) 2>/dev/null |
||||
Loading…
Reference in new issue