[role="xpack"]

:modulename: suricata
:has-dashboards: true

== Suricata module

include::{libbeat-dir}/shared/integration-link.asciidoc[]

This is a module to the Suricata IDS/IPS/NSM log. It parses logs that are in the
https://suricata.readthedocs.io/en/latest/output/eve/eve-json-format.html[
Suricata Eve JSON format].

include::../include/what-happens.asciidoc[]

include::../include/gs-link.asciidoc[]

[float]
=== Compatibility

This module has been developed against Suricata v4.0.4, but is expected to work
with other versions of Suricata.

include::../include/configuring-intro.asciidoc[]

This is an example of how to overwrite the default log file path.

[source,yaml]
----
- module: suricata
  eve:
    enabled: true
    var.paths: ["/my/path/suricata.json"]
----

:fileset_ex: eve

include::../include/config-option-intro.asciidoc[]

[float]
==== `eve` log fileset settings

include::../include/var-paths.asciidoc[]

*`var.tags`*::

A list of tags to include in events. Including `forwarded` indicates that the
events did not originate on this host and causes `host.name` to not be added to
events. Defaults to `[suricata]`.

`var.internal_networks`::

A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
`network.direction`. The values
can be either a CIDR value or one of the named ranges supported by the
<<condition-network, `network`>> condition. The default value is `[private]`
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.

[float]
=== Example dashboard

This module comes with sample dashboards. For example:

[role="screenshot"]
image::./images/filebeat-suricata-events.png[]

[role="screenshot"]
image::./images/filebeat-suricata-alerts.png[]

:has-dashboards!:

:fileset_ex!:

:modulename!:

