diff --git a/src/opnsense/mvc/app/controllers/OPNsense/IDS/forms/generalSettings.xml b/src/opnsense/mvc/app/controllers/OPNsense/IDS/forms/generalSettings.xml index a8945463e..93a12760f 100644 --- a/src/opnsense/mvc/app/controllers/OPNsense/IDS/forms/generalSettings.xml +++ b/src/opnsense/mvc/app/controllers/OPNsense/IDS/forms/generalSettings.xml @@ -23,6 +23,16 @@ checkbox + + ids.general.syslog_eve + + checkbox + + ids.general.MPMAlgo diff --git a/src/opnsense/mvc/app/models/OPNsense/IDS/IDS.xml b/src/opnsense/mvc/app/models/OPNsense/IDS/IDS.xml index ff2c5dfd4..24a64788c 100644 --- a/src/opnsense/mvc/app/models/OPNsense/IDS/IDS.xml +++ b/src/opnsense/mvc/app/models/OPNsense/IDS/IDS.xml @@ -1,6 +1,6 @@ //OPNsense/IDS - 1.0.2 + 1.0.3 OPNsense IDS @@ -169,6 +169,10 @@ 0 Y + + 0 + Y + 0 Y diff --git a/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml b/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml index d90892409..a9227721b 100644 --- a/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml +++ b/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml @@ -123,6 +123,25 @@ outputs: # per flow direction. All logs each dropped pkt. # - ssh +{% if not helpers.empty('OPNsense.IDS.general.syslog_eve') %} + # Extensible Event Format (nicknamed EVE) to syslog + - eve-log: + enabled: yes + type: syslog + identity: "suricata" + facility: local5 + level: Info + types: + - alert: +{% if not helpers.empty('OPNsense.IDS.general.LogPayload') %} + payload: yes + payload-buffer-size: 100kb + payload-printable: yes +{% endif %} + http: yes + tls: yes +{% endif %} + # alert output for use with Barnyard2 - unified2-alert: enabled: no