The OISF (Open Information Security Foundation) release of the intrusion detection and prevention system , which provides tools for inspecting various types of traffic. In Suricata configurations, it is permissible to engage , developed by the Snort project, as well as rule sets and . The source codes of the project is licensed under GPLv2.
Key Changes:
- New parsing and logging modules for the protocols
RDP, SNMP, and SIP, written in Rust, have been introduced. The FTP parsing module has added logging capabilities through the EVE subsystem, which provides event output in JSON format; - In addition to the support for the JA3 client identification method introduced in the previous release, support for the , method has been added, which allows identifying what software is being used to establish connections based on the features of connection negotiation and specified parameters (for example, it allows identifying the use of Tor and other typical applications). JA3 enables the identification of clients, while JA3S identifies servers. The identification results can be used in the rule language and logs;
- An experimental capability for matching against large datasets has been added, implemented through new operations . For example, this capability is applicable for searching patterns in large blacklists containing millions of entries;
- In HTTP inspection mode, full coverage of all situations described in the test suite has been ensured (for example, it encompasses methods used to hide malicious activity in traffic);
- Module development tools in Rust have been elevated from options to mandatory built-in features. Further plans include expanding the use of Rust in the project codebase and gradually replacing modules with alternatives developed in Rust;
- The protocol detection engine has been improved to enhance accuracy and processing of asynchronous traffic flows;
- Support for a new type of record "anomaly" has been added to EVE logs, which retain atypical events detected during packet decoding. The EVE log also has expanded information reflecting VLAN and traffic capture interfaces. An option has been added to save all HTTP headers in the HTTP log records of EVE;
- The eBPF-based handlers support hardware mechanisms for accelerating packet capture. Currently, hardware acceleration is limited to Netronome network adapters, but support for other equipment will be available soon.
- The code for capturing traffic has been rewritten using the Netmap framework. Extended capabilities of Netmap, such as a virtual switch, have been added. ;
- support for a new keyword detection scheme for "Sticky Buffers". The new scheme is defined in the format "protocol.buffer", for example, for inspecting URIs the keyword will take the form "http.uri" instead of "http_uri";
- All Python code used has been checked for compatibility with
Python 3; - Support for the Tilera architecture, the dns.log text log, and the old files-json.log log has been discontinued.
Features of Suricata:
- Using a unified format for outputting verification results , which is also used by the Snort project, allows the use of standard analysis tools such as . Integration with BASE, Snorby, Sguil, and SQueRT products is possible. Support for output in PCAP format;
- Support for automatic protocol detection (IP, TCP, UDP, ICMP, HTTP, TLS, FTP, SMB, etc.), allowing operation in rules based solely on the protocol type, without being tied to a port number (for example, blocking HTTP traffic on a non-standard port). There are decoders for HTTP, SSL, TLS, SMB, SMB2, DCERPC, SMTP, FTP, and SSH protocols;
- A powerful HTTP traffic analysis system that uses a special library, HTP, created by the author of the Mod_Security project, for parsing and normalizing HTTP traffic. A module for keeping a detailed log of transit HTTP transfers is available, and the log is saved in standard
Apache format. The extraction and verification of files transmitted via the HTTP protocol is supported. There is support for parsing compressed content. Identification by URI, Cookie, headers, user-agent, and request/response body is possible; - Support for various interfaces for traffic interception, including NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING. Analysis of already saved files in PCAP format is possible;
- High performance, capable of processing streams of up to 10 gigabits/second on standard hardware.
- A high-performance pattern matching mechanism with large sets of IP addresses. Support for content filtering by masks and regular expressions. Extraction of files from traffic, including identification by name, type, or MD5 checksum.
- The ability to use variables in rules: you can save information from the stream and later use it in other rules;
- Using the YAML format in configuration files, which allows for clarity while being easy for machine processing;
- Full support for IPv6;
- Built-in engine for automatic defragmentation and reassembly of packets, allowing for correct stream processing, regardless of the order of packet arrival;
- Support for tunneling protocols: Teredo, IP-IP, IP6-IP4, IP4-IP6, GRE;
- Support for packet decoding: IPv4, IPv6, TCP, UDP, SCTP, ICMPv4, ICMPv6, GRE, Ethernet, PPP, PPPoE, Raw, SLL, VLAN;
- Logging mode for keys and certificates involved in TLS/SSL connections;
- The ability to write scripts in Lua for enhanced analysis and implementation of additional features necessary for identifying types of traffic where standard rules are insufficient.
Source: opennet.ru
