Skip to main content

A simple ZMQ app to connect to Threat Bus and ingest indicators as Suricata rules via `suricatasc`

Project description

Suricata Threat Bus App

Threat Bus is a publish-subscribe broker for threat intelligence. It is expected that applications register themselves at the bus. Since Suricata can't do that on it's own (yet) this app works as a bridge application in the meantime.

It receives indicators from Threat Bus and picks up all those where the STIX-2 pattern_type equals "suricata". The suricata rules from those IoCs are then forwarded to Suricata using a pre-configured rules file and then reloaded via suricatasc.

Make sure to run this app on the same host as your Suricata installation. Make also sure that this app (e.g., user running this app) has the correct permissions to use the suricatasc command line utility and can read/write the rules file.

Received rule updates are not applied instantaneously to minimize load on Suricata. Instead, users must configure the reload_interval (seconds) in the config file to enable periodic reloads for Suricata to pick up rule changes.

Quick Start

You can configure the app via a YAML configuration file. See config.yaml.example for an example config file. Rename the example to config.yaml before starting.

Alternatively, configure the app via environment variables, similarly to Threat Bus, or pass a path to configuration file via -c /path/to/config.yaml.

Install suricata-threatbus in a virtualenv and start:

python -m venv venv
source venv/bin/activate
make dev-mode
suricata-threatbus

You first need to configure the rules_file option in the config file. See also below for configuring your local Suricata installation to work with this app.

Suricata Preparation

This app maintains a file with Suricata rules. The app writes to it and Suricata reads from it. You need to make this file known to your Suricata installation by adding it to the rules configuration section in the suricata.yaml config file. Suricata won't pick up rule changes if you skip this step.

Here is an example snippet to add to your Suricata config file:

/etc/suricata/suricata.yaml
--------------------------------------------------------------------------------

....

default-rule-path: /var/lib/suricata/rules

rule-files:
  - suricata.rules
  - threatbus.rules         # !! managed by suricata-threatbus

....

In this example, we configure Suricata to read additional rules from a file called threatbus.rules, located in the default rule path /var/lib/suricata/rules.

You need to provide the path of your custom rule file to this app, so it can modify the file contents when new indicators arrive. See also the rules_file config option in the config.yaml.example file.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

suricata-threatbus-2021.11.18.tar.gz (9.1 kB view details)

Uploaded Source

Built Distribution

suricata_threatbus-2021.11.18-py3-none-any.whl (8.1 kB view details)

Uploaded Python 3

File details

Details for the file suricata-threatbus-2021.11.18.tar.gz.

File metadata

  • Download URL: suricata-threatbus-2021.11.18.tar.gz
  • Upload date:
  • Size: 9.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.6.0 importlib_metadata/4.8.2 pkginfo/1.7.1 requests/2.26.0 requests-toolbelt/0.9.1 tqdm/4.62.3 CPython/3.8.12

File hashes

Hashes for suricata-threatbus-2021.11.18.tar.gz
Algorithm Hash digest
SHA256 271a34518da4e08e59a173cced83594ea6423e906f249f7d75feb6a6512a38de
MD5 bb303e4d4a2cc431d4eb1bc73b0d7755
BLAKE2b-256 3bba6792cb7076638a755255e64354cce9fc6ba7672de92ee36d124ee5044e5e

See more details on using hashes here.

File details

Details for the file suricata_threatbus-2021.11.18-py3-none-any.whl.

File metadata

  • Download URL: suricata_threatbus-2021.11.18-py3-none-any.whl
  • Upload date:
  • Size: 8.1 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.6.0 importlib_metadata/4.8.2 pkginfo/1.7.1 requests/2.26.0 requests-toolbelt/0.9.1 tqdm/4.62.3 CPython/3.8.12

File hashes

Hashes for suricata_threatbus-2021.11.18-py3-none-any.whl
Algorithm Hash digest
SHA256 6243dd4d448e83dbb3b801be52846d1b1a7c86a4a227c6711041afc6179f1827
MD5 690be92833c234944bb533c64ad8d887
BLAKE2b-256 6cd551ff542ba584a9b0ecb743ffe24284f175d6bb46ea36ce358ed518027e75

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page