How To: Suricata on pfSense
In the Suricata configuration, change the EVE output from Syslog to File. This will start writing logs to a local file on your pfSense system, which we can then use Syslog-NG to read and forward on.
Install syslog-NG from the pfSense package library
Enable syslog-NG
On the General tab, tick the option to enable syslog-NG and save the configuration.
Go to the "Advanced tab" Syslog-NG is comprised of three components. An input, processor and output.
The following example uses a wildcard pattern to find any files in sub-directories called eve.json. You can probably remove the program-override option if not needed for your scenario. This simply tags the "program" field in logstash with "suricata".
Add a new object using the "Add" button. Set the name to "Suricata", the Object Type as "Source" and populate with the code included below.
{
wildcard-file(
base-dir("/var/log/suricata")
filename-pattern("eve.json")
recursive(yes)
follow-freq(1)
program-override("suricata")
flags(no-parse)
);
};
The host-override parameter may be required if Syslog-NG doesn't send the host as the source IP. This overrides the host value for the events when coming into logstash.
Add another object, this time as an object type of "Log".
{
source(Suricata);
destination(Suricata);
};
Add the final object, this time as an object type of "Destination"
{
tcp("logstash.local"
port(5140)
failover( servers("192.168.0.10", "10.0.0.10") )
);
};
The failover( servers("192.168.0.10", "10.0.0.10") ) parameter is only required where you have multiple logstash instances you want to send to. This doesn't duplicate logs, simply loadbalances endpoints.
If you have previously installed syslog-NG, you'll need to untick the following checkbox depicted below:
