{"id":96219,"date":"2020-10-09T13:42:03","date_gmt":"2020-10-09T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0"},"modified":"2020-10-09T13:42:03","modified_gmt":"2020-10-09T11:42:03","slug":"vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","title":{"rendered":"Sissetungi avastamise s\u00fcsteemi Suricata 6.0 v\u00e4ljaanne","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>P\u00e4rast aasta arendust vabastas OISF (Open Information Security Foundation) organisatsioon <noindex><a rel=\"nofollow\" href=\"https:\/\/suricata-ids.org\/2020\/10\/08\/suricata-6-0-0-released\">avalikustas<\/a><\/noindex> v\u00f5rgusisendi avastamise ja ennetamise s\u00fcsteemi v\u00e4ljaanne <noindex><a rel=\"nofollow\" href=\"http:\/\/suricata-ids.org\/\">Suricata 6.0<\/a><\/noindex>, mis pakub erinevat t\u00fc\u00fcpi liikluse inspekteerimise vahendeid. Suricata konfiguratsioonides on lubatud kasutada <noindex><a rel=\"nofollow\" href=\"http:\/\/www.snort.org\/vrt\">signatuuride andmebaasi<\/a><\/noindex>, mille arendamine toimub projekti Snort raames, samuti reeglistikke <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreats.net\/\">Emerging Threats<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreatspro.com\/\">Emerging Threats Pro<\/a><\/noindex>. Projekti l\u00e4htekoodid <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OISF\/suricata\">levitatakse<\/a><\/noindex> on GPLv2 litsentsi all. <\/p>\n<p>Peamised muudatused:<\/p>\n<ul>\n<li class=\"l\"> Algne toetus HTTP\/2-le.\n<li class=\"l\"> Toetatakse protokolle RFB ja MQTT, sealhulgas protokolli m\u00e4\u00e4ramine ja logimine.\n<li class=\"l\"> Logimise v\u00f5imalus DCERPC protokollile.\n<li class=\"l\"> Oluline t\u00f5us logimise j\u00f5udluses EVE s\u00fcsteemis, mis v\u00f5imaldab s\u00fcndmuste v\u00e4ljundit JSON formaadis. Kiirus on saavutatud t\u00e4nu uue JSON andmete koostaja rakendusele, kirjutatud Rusti keeles.\n<li class=\"l\"> EVE logis\u00fcsteemi mastaapsust on parendatud ning rakendatud on eraldi logifaili v\u00f5imalus iga vooga.\n<li class=\"l\"> V\u00f5imalus m\u00e4\u00e4rata tingimused logi andmete t\u00fchistamiseks.\n<li class=\"l\"> V\u00f5imalus kajastada MAC-aadresse EVE logis ja suurendada DNS logi detailsust.\n<li class=\"l\"> Voolu t\u00f6\u00f6tlemise mootori (flow engine) j\u00f5udluse t\u00f5us.\n<li class=\"l\"> Toetatakse SSH rakenduste identifitseerimist (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/salesforce\/hassh\">HASSH<\/a><\/noindex>).\n<li class=\"l\"> GENEVE tunnelite dekooderi rakendamine.\n<li class=\"l\"> Kood, mis on kirjutatud Rusti keeles, on \u00fcmber kirjutatud t\u00f6\u00f6tlemiseks <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/ASN.1\">ASN.1<\/a><\/noindex>, DCERPC ja SSH. Rustis on ka rakendatud uute protokollide tugi.\n<li class=\"l\"> Reeglite m\u00e4\u00e4ratlemise keeles on v\u00f5tmes\u00f5nasse byte_jump lisatud tugi parameetrile from_end ning byte_test'i puhul parameetrile bitmask. On rakendatud v\u00f5tmes\u00f5na pcrexform, mis v\u00f5imaldab kasutada regulaaravaldisi (pcre) alamstringi haaramiseks. Lisatud on urldecode'i teisendamine. Lisatud on v\u00f5tmes\u00f5na byte_math.\n<li class=\"l\"> V\u00f5imalus kasutada cbindgenit sidemete genereerimiseks Rusti ja C keeltes.\n<li class=\"l\"> Algne tugi pluginatele on lisatud.\n<\/ul>\n<p>Suricata omadused:\n<\/p>\n<ul>\n<li class=\"l\"> \u00dchtse vormingu kasutamine tulemuste v\u00e4ljundiks <noindex><a rel=\"nofollow\" href=\"http:\/\/searchsecuritychannel.techtarget.com\/tip\/0,289483,sid97_gci1339679,00.html\">Unified2<\/a><\/noindex>, mida kasutab ka Snorti projekt, v\u00f5imaldades kasutada standardseid anal\u00fc\u00fcsi t\u00f6\u00f6riistu, nagu <noindex><a rel=\"nofollow\" href=\"http:\/\/www.securixlive.com\/barnyard2\/index.php\">barnyard2<\/a><\/noindex>. Integreerimisv\u00f5ime BASE, Snorby, Sguil ja SQueRT toodetega. Toetab v\u00e4ljundit PCAP formaadis;\n<\/li>\n<li class=\"l\">  Automaatse protokollide m\u00e4\u00e4ratlemise toetus (IP, TCP, UDP, ICMP, HTTP, TLS, FTP, SMB jne), mis v\u00f5imaldab kasutada reeglite koostamisel ainult protokolli t\u00fc\u00fcpi, s\u00f5ltumata pordi numbrist (n\u00e4iteks blokeerida HTTP liiklus mittestandardsel portis). Otsustamiseks on olemas dekooderid protokollidele HTTP, SSL, TLS, SMB, SMB2, DCERPC, SMTP, FTP ja SSH;\n<\/li>\n<li class=\"l\"> V\u00f5imas HTTP liikluse anal\u00fc\u00fcsis\u00fcsteem, mis kasutab HTTP liikluse anal\u00fc\u00fcsimiseks ja normaliseerimiseks spetsiaalset HTP teeki, mille on loonud Mod_Security projekti autor. Kergesti saadaval moodul, mis tagab \u00fcksikasjaliku logi, mis salvestatakse standardformaadis<br \/>\nApache. Toetab failide k\u00e4ttesaamist ja kontrollimist, mis edastatakse l\u00e4bi HTTP protokolli. Toetab kokkusurutud sisu anal\u00fc\u00fcsi. Pakub identifitseerimise v\u00f5imalust URI, k\u00fcpsiste, p\u00e4iste, user-agent'i, p\u00e4ringu\/vastuse keha kaudu;<\/p>\n<\/li>\n<li class=\"l\"> Toetab erinevaid liideseid liikluse katmiseks, sealhulgas NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING. Saate anal\u00fc\u00fcsida juba salvestatud faile PCAP formaadis;\n<\/li>\n<li class=\"l\"> K\u00f5rge j\u00f5udlus, v\u00f5ime t\u00f6\u00f6delda tavalises seadmes voogusid kuni 10 gigabitti sekundis.\n<\/li>\n<li class=\"l\"> K\u00f5rge j\u00f5udlusega maski vastenduss\u00fcsteem suurte IP-aadresside kogumite jaoks. Toetab sisu eraldamist maske ja regulaaravaldiseid. Failide eraldamine liiklusest, sealhulgas nende tuvastamine nime, t\u00fc\u00fcbi v\u00f5i MD5-kontrollsummaga.\n<\/li>\n<li class=\"l\"> Muutujate kasutamise v\u00f5imalus reeglites: voost teabe salvestamine ja hilisem kasutamine teistes reeglites.\n<\/li>\n<li class=\"l\"> YAML-formaadi kasutamine konfiguratsioonifailides, mis tagab selguse ja lihtsa masinaprotsessi.\n<\/li>\n<li class=\"l\"> T\u00e4ielik IPv6 toetus.\n<\/li>\n<li class=\"l\"> Integreeritud mootor automaatseks defragmentimiseks ja pakettide rekonstrueerimiseks, mis tagab liiklusvoogude \u00f5ige t\u00f6\u00f6tlemise, s\u00f5ltumata pakettide vastuv\u00f5tmise j\u00e4rjekorrast.\n<\/li>\n<li class=\"l\"> Tunneli protokollide toetus: Teredo, IP-IP, IP6-IP4, IP4-IP6, GRE.\n<\/li>\n<li class=\"l\"> Pakettide dekodeerimise toetus: IPv4, IPv6, TCP, UDP, SCTP, ICMPv4, ICMPv6, GRE, Ethernet, PPP, PPPoE, Raw, SLL, VLAN.\n<\/li>\n<li class=\"l\"> TLS\/SSL-\u00fchenduste v\u00f5tmete ja sertifikaatide logimise re\u017eiim.\n<\/li>\n<li class=\"l\"> Lua keeles skriptide kirjutamise v\u00f5imalus, et v\u00f5imaldada t\u00e4iendavat anal\u00fc\u00fcsi ja rakendada t\u00e4iendavaid funktsioone, mis on vajalikud liikluset\u00fc\u00fcpide m\u00e4\u00e4ratlemiseks, mille jaoks standardsed reeglid ei ole piisavad.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53857\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 Suricata 6.0, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0438\u043d\u0441\u043f\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 Suricata \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0430\u0437\u044b \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Snort, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b Emerging Threats \u0438 Emerging Threats Pro. \u0418\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-96219","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Suricata r\u00fcnde tuvastuss\u00fcsteemi v\u00e4ljaanne 6.0 | ProHoster","description":"P\u00e4rast aasta arendust vabastas OISF (Open Information Security Foundation) s\u00fcsteemi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T11:42:03+00:00","article:modified_time":"2020-10-09T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96219","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:22","updated":"2022-10-02 08:38:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/96219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=96219"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/96219\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=96219"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=96219"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=96219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}