见官网
https://suricata.readthedocs.io/en/latest/configuration/index.html#
-
8.1. Suricata.yaml
- 8.1.1. Max-pending-packets
- 8.1.2. Runmodes
- 8.1.3. Default-packet-size
- 8.1.4. User and group
- 8.1.5. PID File
- 8.1.6. Action-order
- 8.1.7. Splitting configuration in multiple files
-
8.1.8. Event output
- 8.1.8.1. Default logging directory
- 8.1.8.2. Outputs
- 8.1.8.3. Line based alerts log (fast.log)
- 8.1.8.4. Eve (Extensible Event Format)
- 8.1.8.5. Alert output for use with Barnyard2 (unified2.alert)
- 8.1.8.6. A line based log of HTTP requests (http.log)
- 8.1.8.7. A line based log of DNS queries and replies (dns.log)
- 8.1.8.8. Packet log (pcap-log)
- 8.1.8.9. Verbose Alerts Log (alert-debug.log)
- 8.1.8.10. Alert output to prelude (alert-prelude)
- 8.1.8.11. Stats
- 8.1.8.12. Syslog
- 8.1.8.13. Drop.log, a line based information for dropped packets
- 8.1.9. Detection engine
- 8.1.10. Threading
- 8.1.11. IP Defrag
- 8.1.12. Flow and Stream handling
- 8.1.13. Application Layer Parsers
- 8.1.14. Engine output
- 8.1.15. Packet Acquisition
- 8.1.16. Rules
- 8.1.17. Engine analysis and profiling
- 8.1.18. Application layers
- 8.1.19. Decoder
- 8.1.20. Advanced Options
- 8.2. Global-Thresholds
- 8.3. Snort.conf to Suricata.yaml
- 8.4. Multi Tenancy
- 8.5. Dropping Privileges After Startup