Skip to main content

A simple ZMQ app to connect to Threat Bus and ingest indicators as Suricata rules via `suricatasc`

Project description

Suricata Threat Bus App

Threat Bus is a publish-subscribe broker for threat intelligence. It is expected that applications register themselves at the bus. Since Suricata can't do that on it's own (yet) this app works as a bridge application in the meantime.

It receives indicators from Threat Bus and picks up all those where the STIX-2 pattern_type equals "suricata". The suricata rules from those IoCs are then forwarded to Suricata using a pre-configured rules file and then reloaded via suricatasc.

Make sure to run this app on the same host as your Suricata installation. Make also sure that this app (e.g., user running this app) has the correct permissions to use the suricatasc command line utility and can read/write the rules file.

Received rule updates are not applied instantaneously to minimize load on Suricata. Instead, users must configure the reload_interval (seconds) in the config file to enable periodic reloads for Suricata to pick up rule changes.

Quick Start

You can configure the app via a YAML configuration file. See config.yaml.example for an example config file. Rename the example to config.yaml before starting.

Alternatively, configure the app via environment variables, similarly to Threat Bus, or pass a path to configuration file via -c /path/to/config.yaml.

Install suricata-threatbus in a virtualenv and start:

python -m venv venv
source venv/bin/activate
make dev-mode
suricata-threatbus

You first need to configure the rules_file option in the config file. See also below for configuring your local Suricata installation to work with this app.

Suricata Preparation

This app maintains a file with Suricata rules. The app writes to it and Suricata reads from it. You need to make this file known to your Suricata installation by adding it to the rules configuration section in the suricata.yaml config file. Suricata won't pick up rule changes if you skip this step.

Here is an example snippet to add to your Suricata config file:

/etc/suricata/suricata.yaml
--------------------------------------------------------------------------------

....

default-rule-path: /var/lib/suricata/rules

rule-files:
  - suricata.rules
  - threatbus.rules         # !! managed by suricata-threatbus

....

In this example, we configure Suricata to read additional rules from a file called threatbus.rules, located in the default rule path /var/lib/suricata/rules.

You need to provide the path of your custom rule file to this app, so it can modify the file contents when new indicators arrive. See also the rules_file config option in the config.yaml.example file.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

suricata-threatbus-2021.11.22.tar.gz (9.1 kB view details)

Uploaded Source

Built Distribution

suricata_threatbus-2021.11.22-py3-none-any.whl (8.1 kB view details)

Uploaded Python 3

File details

Details for the file suricata-threatbus-2021.11.22.tar.gz.

File metadata

  • Download URL: suricata-threatbus-2021.11.22.tar.gz
  • Upload date:
  • Size: 9.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.6.0 importlib_metadata/4.8.2 pkginfo/1.8.1 requests/2.26.0 requests-toolbelt/0.9.1 tqdm/4.62.3 CPython/3.8.12

File hashes

Hashes for suricata-threatbus-2021.11.22.tar.gz
Algorithm Hash digest
SHA256 9526f4d0b42a6d451a1751865fdde25d4ad26831dc0efcbf0575e3929fdec974
MD5 f97b903cf47a64729478b778f98272b8
BLAKE2b-256 38635f03abfdcecddc45e0034817dbea9586f45bc60adeea6c467328bd0d0a3a

See more details on using hashes here.

File details

Details for the file suricata_threatbus-2021.11.22-py3-none-any.whl.

File metadata

  • Download URL: suricata_threatbus-2021.11.22-py3-none-any.whl
  • Upload date:
  • Size: 8.1 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.6.0 importlib_metadata/4.8.2 pkginfo/1.8.1 requests/2.26.0 requests-toolbelt/0.9.1 tqdm/4.62.3 CPython/3.8.12

File hashes

Hashes for suricata_threatbus-2021.11.22-py3-none-any.whl
Algorithm Hash digest
SHA256 575b80bad7b1f8da7806f34735c0b528348832caeb96162099c53261f8f89fe8
MD5 32a0a59a4de08bea0481c3da33700c3d
BLAKE2b-256 3d0be46d294b088e1a494b8832e0e92bc51a76cc731892302e6bbf5805b317c9

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page