PacketFence - BTS - PacketFence
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0001141PacketFenceIDSpublic2010-12-20 09:262012-08-07 09:53
Reporterfgaudreault 
Assigned Toobilodeau 
PrioritylowSeverityfeatureReproducibilityN/A
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version2.0.0 
Target Version3.5.0Fixed in Version3.5.0 
fixed in git revision
fixed in mtn revision
Summary0001141: Support for surricata IDS
DescriptionSuricata is another SNORT-like IDS coded in C. With our early tests, it would be possible to integrate it in PacketFence. However, we need suricata developpers to add the "log to socket" support.
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
related to 0000956closed fgaudreault confusion between trapping.range, pf.conf's interfaces and networks.conf 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2010-12-20 09:26fgaudreaultNew Issue
2011-03-15 17:03fgaudreaultStatusnew => assigned
2011-03-15 17:03fgaudreaultAssigned To => fgaudreault
2011-03-15 17:05fgaudreaultNote Added: 0001929
2011-03-15 17:06fgaudreaultTarget Version3 => 2.2.0
2011-03-15 17:07fgaudreaultNote Added: 0001930
2011-05-04 11:36obilodeauNote Added: 0002055
2011-05-04 11:36obilodeauTarget Version2.2.0 => +1
2011-10-11 16:39fgaudreaultNote Added: 0002335
2011-10-13 15:30fgaudreaultNote Added: 0002344
2011-10-13 15:30fgaudreaultAssigned Tofgaudreault => obilodeau
2011-10-13 15:31fgaudreaultTag Attached: Code Review
2011-10-14 09:18obilodeauNote Added: 0002348
2011-10-14 09:19obilodeauRelationship addedrelated to 0000956
2012-01-06 09:05fgaudreaultDescription Updated
2012-08-01 14:09fgaudreaultNote Added: 0002857
2012-08-01 14:09fgaudreaultStatusassigned => closed
2012-08-01 14:09fgaudreaultResolutionopen => fixed
2012-08-01 14:09fgaudreaultFixed in Version => 3.5.0
2012-08-03 10:20dwuelfrathTag Detached: Code Review
2012-08-07 09:53obilodeauTarget Version+1 => 3.5.0

Notes
(0001929)
fgaudreault   
2011-03-15 17:05   
Using suricata 1.1beta1 can now interact with PF. We can see the alerts coming in the packetfence.log.

Now to officially support suricata, we need to refactor the detection part to allow support for different IDS, and make the IDS selectable via a configuration settings.
(0001930)
fgaudreault   
2011-03-15 17:07   
Reminder sent to: obilodeau

I guess you would like to follow this thread...
(0002055)
obilodeau   
2011-05-04 11:36   
re-targeted for +1 release
(0002335)
fgaudreault   
2011-10-11 16:39   
Adding variable to select snort or surricata under trapping. I will name it :

trapping.detection_engine

so :
trapping.detection_engine=snort|surricata

That will be very easy afterward to enable surricata support.

I started a new branch for that integration.

org.packetfence.feature.suricata
(0002344)
fgaudreault   
2011-10-13 15:30   
Integration is working.

To be reviewed prior merge.
(0002348)
obilodeau   
2011-10-14 09:18   
Did review in 0000956. Sorry for the confusion.
(0002857)
fgaudreault   
2012-08-01 14:09   
Fixed in 3.5.0