Suricata 5.0 osofaʻiga faʻaogaina faiga o loʻo avanoa

Faalapotopotoga OISF (Open Information Security Foundation) lomia fa'asa'olotoina o feso'ota'iga feso'ota'iga su'esu'ega ma faiga puipuia Meerkat 5.0, lea e maua ai meafaigaluega mo le asiasia o ituaiga eseese o feoaiga. I Suricata configurations e mafai ona faʻaoga fa'amaumauga saini, atiina ae e le Snort poloketi, faʻapea foʻi ma seti o tulafono Fa'amata'u Fa'atupu и Emerging Threats Pro. Punaoa o poloketi salalau laiseneina ile GPLv2.

Suiga autu:

• Ua fa'alauiloa mai ni fa'atonuga fou mo le fa'avasegaina ma le fa'amauina
  RDP, SNMP ma SIP tusia i le Rust. O le mafai ona fa'aoga e ala i le EVE subsystem ua fa'aopoopoina i le FTP parsing module, tu'uina atu mea na tutupu i le JSON format;

• I le faaopoopo atu i le lagolago mo le JA3 TLS tagata e iloagofie ai auala na aliali mai i le faʻasalalauga mulimuli, lagolago mo le metotia JA3S, faataga Faʻavae i luga o uiga o fefaʻatauaʻiga fesoʻotaʻiga ma taʻiala faʻapitoa, fuafua poʻo le a le polokalama e faʻaaogaina e faʻavae ai se fesoʻotaʻiga (mo se faʻataʻitaʻiga, e mafai ai e oe ona fuafua le faʻaogaina o Tor ma isi faʻaoga masani). JA3 fa'atagaina oe e fa'amatala tagata fa'atau, ma fa'atagaina oe e JA3S e fa'amatala ai 'au'aunaga. O taunu'uga o le fa'ai'uga e mafai ona fa'aoga i le gagana fa'atulagaina tulafono ma i totonu o ogalaau;
• Faʻaopoopo le faʻataʻitaʻiga tomai e faʻafetaui faʻataʻitaʻiga mai faʻamaumauga tetele, faʻatinoina e faʻaaoga ai galuega fou fa'amaumauga ma fa'amaumauga. Mo se faʻataʻitaʻiga, o le faʻaaliga e faʻatatau i le suʻeina o matapulepule i lisi uliuli tetele o loʻo i ai le faitau miliona o faʻamaumauga;
• O le su'ega HTTP e maua ai le fa'amatalaga atoa o tulaga uma o lo'o fa'amatalaina ile su'ega su'ega HTTP Evader (fa'ata'ita'iga, o lo'o ufiufi ai metotia fa'aoga e natia ai gaioiga leaga i feoaiga);
• Meafaigaluega mo le atinaʻeina o modules i le gagana Rust ua faʻafeiloaʻi mai filifiliga i agavaʻa faʻatulafonoina. I le lumanaʻi, ua fuafua e faʻalautele le faʻaogaina o le Rust i le faʻavae o le poloketi ma faasolosolo malie ona suia modules ma analogues na atiae i Rust;
• Ua fa'aleleia atili le fa'auigaina o le afi e fa'aleleia atili ai le sa'o ma fa'atautaia fe'avea'i fe'avea'i asynchronous;
• Lagolago mo se ituaiga "anomaly" fou e faʻapipiʻi i le EVE log, lea e teu ai mea faʻapitoa e iloa pe a faʻavasega pepa. Ua fa'alauteleina fo'i e le EVE le fa'aaliga o fa'amatalaga e uiga i VLANs ma feso'ota'iga pu'eina fefa'ataua'iga. Fa'aopoopo le filifiliga e fa'asaoina uma ulutala HTTP ile EVE http log fa'amaumauga;
• E tu'uina atu e le au fa'avae eBPF le lagolago mo masini masini mo le fa'avaveina o le pu'eina o pepa. O le fa'avavevave o meafaigaluega e fa'atapula'a nei i feso'ota'iga feso'otaiga a Netronome, ae o le a vave ona avanoa mo isi masini;
• O le tulafono mo le pu'eina o feoaiga e fa'aaoga ai le Netmap framework ua toe tusia. Fa'aopoopoina le tomai e fa'aoga ai uiga fa'apitoa Netmap e pei o se kilia virtual VALE;
• Faaopoopo lagolago mo se polokalame fa'amalamalamaga fou mo Sticky Buffers. O le polokalame fou o loʻo faʻamatalaina i le "protocol.buffer" format, mo se faʻataʻitaʻiga, mo le asiasia o se URI, o le upu autu o le a avea ma foliga "http.uri" nai lo le "http_uri";
• O le Python code uma na faʻaaogaina e faʻataʻitaʻiina mo le fetaui ma
  Python3;

• Lagolago mo le fausaga o Tilera, o le log text dns.log ma le log files-json.log tuai ua fa'agata.

Fa'ailoga o Suricata:

• Fa'aaogāina ose fa'asologa e fa'aalia ai fa'ai'uga fa'ata Tuufaatasi2, faʻaaogaina foi e le Snort project, lea e faʻatagaina ai le faʻaogaina o meafaigaluega faʻavasega masani e pei o lotoa2. Avanoa o faʻatasi ma BASE, Snorby, Sguil ma SQueRT oloa. Lagolago galuega faatino a le PCAP;
• Lagolago mo le suʻesuʻeina otometi o faʻasalalauga (IP, TCP, UDP, ICMP, HTTP, TLS, FTP, SMB, ma isi), faʻatagaina oe e faʻagaoioia i tulafono e naʻo le ituaiga protocol, e aunoa ma le faʻasino i le numera o le taulaga (mo se faʻataʻitaʻiga, poloka HTTP feoaiga i luga o se uafu e le masani ai) . Avanoa o decoders mo HTTP, SSL, TLS, SMB, SMB2, DCERPC, SMTP, FTP ma SSH protocols;
• O se faiga suʻesuʻega faʻatautaia HTTP mamana e faʻaaogaina se faletusi HTP faʻapitoa na faia e le tusitala o le Mod_Security project e faʻavasega ma faʻavasegaina fefaʻatauaʻiga HTTP. O lo'o avanoa se module mo le fa'atumauina o fa'amaumauga au'ili'ili o felauaiga HTTP felauaiga; o lo'o fa'asaoina le ogalaau i se faatulagaga masani
  Apache. E lagolagoina le toe aumai ma le siakiina o faila na lafoina e ala i le HTTP. Lagolago mo le fa'avasegaina o mea fa'apipi'i. Malosiaga e faʻailoa e le URI, Kuki, ulutala, tagata faʻaoga-sui, tino talosaga / tali;

• Lagolago mo fesoʻotaʻiga eseese mo faʻalavelave faʻalavelave, e aofia ai le NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING. E mafai ona au'ili'ili faila ua uma ona fa'asaoina ile fa'atulagaga PCAP;
• Faʻatinoga maualuga, mafai ona faʻagasolo tafega e oʻo atu i le 10 gigabits / sec i luga o meafaigaluega masani.
• Fa'atusa matapulega maualuga mo seti tele o tuatusi IP. Lagolago mo le filifilia o mea e ala ile matapulepule ma faʻamatalaga masani. Tu'uesea faila mai fefa'ataua'iga, e aofia ai lo latou fa'ailoaina ile igoa, ituaiga po'o le MD5 siaki.
• Malosiaga e fa'aoga fesuiaiga i tulafono: e mafai ona e fa'asaoina fa'amatalaga mai se vaitafe ma fa'aaoga mulimuli ane i isi tulafono;
• Faʻaaogaina o le YAML faʻasologa i faila faʻatulagaina, lea e mafai ai ona e faʻatumauina le manino aʻo faigofie i le faʻaogaina o masini;
• Lagolago atoatoa IPv6;
• O le afi faʻapipiʻiina mo le faʻapipiʻiina otometi ma le toe faʻapipiʻiina o afifi, faʻatagaina mo le faʻaogaina saʻo o vaitafe, e tusa lava po o le a le faʻatonuga e taunuu mai ai pusa;
• Lagolago mo tunneling protocols: Teredo, IP-IP, IP6-IP4, IP4-IP6, GRE;
• Lagolago le fa'avasegaina o pepa: IPv4, IPv6, TCP, UDP, SCTP, ICMPv4, ICMPv6, GRE, Ethernet, PPP, PPPoE, Raw, SLL, VLAN;
• Faiga mo logging ki ma tusi faamaonia o loʻo faʻaalia i totonu o fesoʻotaʻiga TLS/SSL;
• Le mafai ona tusia ni tusitusiga i le Lua e tu'uina atu ai au'ili'iliga fa'apitoa ma fa'atino tomai fa'aopoopo e mana'omia e fa'ailoa ai ituaiga ta'avale e le o lava tulafono masani.

puna: opennet.ru