Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong (?) configuration for Suricata classification & reference #262

Open
kam193 opened this issue Sep 13, 2024 · 0 comments
Open

Wrong (?) configuration for Suricata classification & reference #262

kam193 opened this issue Sep 13, 2024 · 0 comments
Assignees
Labels
assess We still haven't decided if this will be worked on or not bug Something isn't working

Comments

@kam193
Copy link

kam193 commented Sep 13, 2024

Describe the bug
Trying to understand issues with Suricata (still not unclear, the only relevant log is pcap_next_ex(): -2), I've found out two small issues - Suricata reports missing additional config files:

[32 - Suricata-Main] 2024-09-13 13:20:18 Warning: classification-config: could not open: "/etc/suricata/classification.config": No such file or directory
[32 - Suricata-Main] 2024-09-13 13:20:18 Error: classification-config: please check the "classification-file" option in your suricata.yaml file
[32 - Suricata-Main] 2024-09-13 13:20:18 Error: reference-config: Error opening file: "/etc/suricata/reference.config": No such file or directory
[32 - Suricata-Main] 2024-09-13 13:20:18 Error: reference-config: please check the "reference-config-file" option in your suricata.yaml file

After verifying config generated by the AL service and the file system, it's turned out files exist, but in the /usr/local/etc/suricata/ directory, while the config points to the /etc/.

To Reproduce
Steps to reproduce the behavior:

  1. Start suricata service
  2. Connect to the container console and read log from /usr/local/var/log/suricata/suricata.log

Expected behavior
This is an open question. The fix is trivial, but my question to Suricata & AL experts is: does it matter? Does it change anything in how AL treats the results, or if Suricata is successful in the analysis?

The Suricata documentation points that it helps to better understand the purpose of rules, but maybe AL just does not use it and thus, it's an intentional misconfiguration?

Screenshots

Environment (please complete the following information if pertinent):

  • Assemblyline Version: 4.5.0.45
  • Suricata service: 4.5.0.34

Additional context

@kam193 kam193 added assess We still haven't decided if this will be worked on or not bug Something isn't working labels Sep 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
assess We still haven't decided if this will be worked on or not bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants