[Feature] Suricata - Add payload support

[guillaume-u]

Hello,

I think it's not already asked (I did not find this feature request).

Is it possible to add the payload support in "eve-log" and display the result in the WebUI ?

 - eve-log:
        - alert:
            payload: yes
            payload-buffer-size: 4kb
            payload-printable: yes
            packet: yes

It will be very useful to get this information to enable/disable/investigate Suricata rules.

Thanks,

Guillaume.

[AdSchellevis]

Hi Guillaume,

It's not already on the list, but indeed quite useful.
To prevent peoples log files from flooding, we should make it an optional feature (if we can find time to implement it).

Best regards,

Ad

[guillaume-u]

Thanks a lot @AdSchellevis, sure it can be an optional feature.

As an ugly hack to enable this functionality manually, you can follow what I wrote in the forum here : https://forum.opnsense.org/index.php?topic=6284.msg26746#msg26746

Quote :

• Enable the payload in eve-log (see above).

• Edit and add : /usr/local/opnsense/mvc/app/controllers/OPNsense/IDS/forms/dialogAlert.xml
  Code: [Select]
  
  payload_printable
  Payload
  info
  

• Edit : /usr/local/opnsense/mvc/app/views/OPNsense/IDS/index.volt (to add the payload entry)
  Code: [Select]
  Modèle:Lang. ('Destination')
  Modèle:Lang. ('Payload')
  Modèle:Lang. ('Alert')

• Edit : /usr/local/opnsense/service/templates/OPNsense/IDS/suricata.yaml and /usr/local/etc/suricata/suricata.yaml
  Code: [Select]
  filename: eve.json

  types:                                                                    
    - alert:                                                                
        payload: yes                                                        
        payload-buffer-size: 100kb                                          
        payload-printable: yes                                              
        packet: yes
  

Nota :
As I didn't really take a look to OPNsense code, I'm not sure that's the good way to make that but It works in my case.
As I said, this is an ugly hack, there is no integration with the UI to enable/disable this functionality. Moreover, an OPNsense update can remove all of these modifications.

[AdSchellevis]

Suricon 2017 seems like a great moment to add this feature...

For now I've only added the printable content, I'm also looking into supporting custom overwrites of the suricata.yaml file for custom (advanced) features.

[AdSchellevis]

To test on a recent version of OPNsense, use : opnsense-patch 14d0ce9

[AdSchellevis]

Some more work done on the alert viewer in 38aafc8 below examples of alerts with and without payload enabled.

[sempervictus]

We pull our OpnSense syslog into ELK, so the more context we could get here, the merrier (not too worried about flooding elastic clusters with FW logs). Thank you much

[AdSchellevis]

@sempervictus thank you for the encouragement!

[fichtner]

All done, thanks!