%YAML 1.1
---

max-pending-packets: 65534
runmode: worker

threading:
  set-cpu-affinity: yes
  cpu-affinity:
    - receive-cpu-set:
        cpu: ["all"]
        mode: "exclusive"
        prio:
          default: "high"
    - detect-cpu-set:
        cpu: ["all"]
        mode: "exclusive"
        prio:
          default: "high"

default-packet-size: 1518

af-packet:
  - interface: mbut1
    threads: 12
    cluster-id: 99
    cluster-type: cluster_cpu
    defrag: no
    checksum-checks: no
    use-mmap: yes
    ring-size: 500000


default-log-dir: /var/log/suricata
logging:
  default-log-level: info
  outputs:
    - console:
        enabled: no
    - file:
        enabled: no
        append: yes
        filename: logs/suricata.log

outputs:
  - unified2-alert:
      enabled: no
      filename: alerts/u2
      limit: 3mb
      payload: no

  - eve-log:
      enabled: no
      filename: logs/eve.json
      types:
        - alert
        - dns
        - http

  - stats:
      enabled: no
      filename: logs/suricata-stats.log
      interval: 10
      append: no

  - eve-log:
      enabled: yes
      filename: events/alert.json
      append: yes
      types:
        - alert:
           payload: yes

  - eve-log:
      enabled: yes
      filename: events/dns.json
      append: yes
      types:
        - dns

  - eve-log:
      enabled: yes
      filename: events/http.json
      append: yes
      types:
      - http:
         extended: yes

  - eve-log:
      enabled: yes
      filename: events/stats.json
      append: yes
      types:
        - stats:
           totals: yes
           threads: no
           deltas: yes

  - eve-log:
      enabled: yes
      filename: events/flows.json
      append: yes
      types:
        - flow

magic-file: /usr/share/misc/magic.mgc

legacy:
  uricontent: enabled

defrag:
  max-frags: 1024
  prealloc: 1000
  timeout: 60

flow:
  memcap: 100mb
  hash-size: 32768
  prealloc: 25000
  emergency-recovery: 30

stream:
  checksum-validation: no
  midstream: yes
  async-oneside: yes
  memcap: 200mb
  reassembly:
    memcap: 32gb
    depth: 0


detect-engine:
  - profile: medium

default-rule-path: /var/lib/suricata

rule-files:
 - evil.rules

threshold-file: /etc/suricata/threshold.conf
classification-file: /etc/suricata/classification.config
reference-config-file: /etc/suricata/reference.config

action-order:
  - pass
  - drop
  - reject
  - alert

vars:
  address-groups:
    HOME_NET: "[10.8.0.0/16]"
    EXTERNAL_NET: "any"
    DNS_SERVERS: "$HOME_NET"
    SMTP_SERVERS: "$HOME_NET"
    HTTP_SERVERS: "$HOME_NET"
    SQL_SERVERS: "$HOME_NET"
    TELNET_SERVERS: "$HOME_NET"
    SIP_SERVERS: "$HOME_NET"
# do not modify
    AIM_SERVERS: "[64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]"

  port-groups:
    HTTP_PORTS: "[36,80,81,82,83,84,85,86,87,88,89,90,311,383,555,591,593,631,801,808,818,901,972,1158,1220,1414,1533,1741,1830,2231,2301,2381,2809,3029,3037,3057,3128,3443,3702,4000,4343,4848,5117,5250,6080,6173,6988,7000,7001,7071,7144,7145,7510,7770,7777,7779,8000,8008,8014,8028,8080,8081,8082,8085,8088,8090,8118,8123,8180,8181,8222,8243,8280,8300,8500,8509,8800,8888,8899,9000,9060,9080,9090,9091,9111,9443,9999,10000,11371,12601,15489,29991,33300,34412,34443,34444,41080,44449,50000,50002,51423,53331,55252,55555,56712]"
    SHELLCODE_PORTS: "[!80]"
    ORACLE_PORTS: "[1024:]"
    SSH_PORTS: "[22,443]"
    FTP_PORTS: "[21,2100,3535]"
    SIP_PORTS: "[5060,5061,5600]"
    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
    GTP_PORTS: "[2123,2152,3386]"


host-os-policy:
  # Make the default policy windows.
  windows: [0.0.0.0/0]
  bsd: []
  bsd-right: []
  old-linux: []
  linux: []
  old-solaris: []
  solaris: []
  hpux10: []
  hpux11: []
  irix: []
  macos: []
  vista: []
  windows2k3: []
