Repository navigation
Format for IP addresses in suricata suppression rules #16308
Version3.3.0 Installation MethodSecurity Onion ISO image Descriptionconfiguration Installation TypeDistributed Locationon-prem with Internet access Hardware SpecsExceeds minimum requirements CPU4 RAM32 Storage for /284G Storage for /nsm700G Network Traffic Collectionspan port Network Traffic Speeds1Gbps to 10Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsNo, there are no additional clues DetailI am creating suppression rules for some suricata alerts and I have an issue with the format of IP addresses in the SOC screens. Can someone please tell me what format I need to use - creating multiple suricata vars is not really realistic for the number of suppressions I need to add. Interesting thing - when it was 2.3 or 2.4 and we used to manually edit the yaml files, 1.2.3.4 was accepted as a valid IP address in suppression rules. Now, via the SOC screens, it has to be 1.2.3.4/32. Whenever I go in and edit an existing suppression rule I have to change the format of all my existing suppressions to add the /32 or /24 etc. at the end, otherwise I get the dreaded 400 error message (meaning invalid format). Guidelines
|
Replies: 2 comments 1 reply
|
In 3.3.0 the SOC UI won't take more than one address in that field. The IP box is checked in the browser by You can add more than one suppress override to the same detection, though. Each enabled override becomes its own line in threshold.config: So for two hosts, add two suppress overrides (1.2.3.4/32 and 1.2.4.5/32) on that rule. If the hosts are in the same range, one /24 or similar covers them in one entry. The odd part is that the server side already allows more. I'd raise it as a bug/feature request so the UI check gets aligned with the backend. Until then it's one override per IP or CIDR. |
|
Great, I thought I was going mad(der). Thanks for the detail |
|
@rosswakelin I have created an issue to track this: #16314 |
In 3.3.0 the SOC UI won't take more than one address in that field. The IP box is checked in the browser by
cidrFormat, which accepts exactly one of: a single IPv4/IPv6 CIDR (/ is required), or a single$VAR/!$VAR. A comma, a quote or a[fails that check, and so does a bare IP without the mask. That's why 1.2.3.4 now needs /32:https://github.com/Security-Onion-Solutions/securityonion-soc/blob/38e4ac0d8617870cb7270a7426ebae7b67cf00a5/html/js/app.js#L311-L315
You can add more than one suppress override to the same detection, though. Each enabled override becomes its own line in threshold.config:
https://github.com/Security-Onion-Solutions/securityonion-soc/blob/38e4ac0d8617870cb7270a742…