suricata 配置文件threshold

threshold

threshold（阈值）关键字可用于控制规则的警报频率，它有3种模式：

threshold: type <threshold|limit|both>, track <by_src|by_dst>, count <N>, seconds <T>

type “threshold”

此类型可用于在规则生成警报之前为其设置最小阈值，下面的例子表示，如果我们在一分钟的时间内从同一台服务器获得10个或更多入站电子邮件则触发警报

alert tcp !$HOME_NET any -> $HOME_NET 25 (msg:"ET POLICY Inbound Frequent Emails - Possible Spambot Inbound"; \
flow:established; content:"mail from|3a|"; nocase;                                                       \
threshold: type threshold, track by_src, count 10, seconds 60;                                           \
reference:url,doc.emergingthreats.net/2002087; classtype:misc-activity; sid:2002087; rev:10;)

type “limit”

这种类型可以用来确保你不会被警报充斥。如果设置为限制N，它最多会发出N次警报，下面的例子表示，如果检测到MSIE 6.0，则每3分钟内最多会生成一个警报

alert http $HOME_NET any -> any $HTTP_PORTS (msg:"ET USER_AGENTS Internet Explorer 6 in use - Significant Security Risk"; \
flow:to_server,established; content:"|0d 0a|User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 6.0|3b|";                \
threshold: type limit, track by_src, seconds 180, count 1;                                                           \
reference:url,doc.emergingthreats.net/2010706; classtype:policy-violation; sid:2010706; rev:7;)

type “both”

这种类型是“threshold”和“limit”类型的组合，下面的例子表示，如果在6分钟内出现了5次或更多的“SIP / 2.0 401未经授权”响应，该警报将仅生成警报，并且在6分钟内仅会发出一次警报

alert tcp $HOME_NET 5060 -> $EXTERNAL_NET any (msg:"ET VOIP Multiple Unauthorized SIP Responses TCP"; \
flow:established,from_server; content:"SIP/2.0 401 Unauthorized"; depth:24;                      \
threshold: type both, track by_src, count 5, seconds 360;                                        \
reference:url,doc.emergingthreats.net/2003194; classtype:attempted-dos; sid:2003194; rev:6;)

track

by_src/by_dst分别表示通过源IP地址/目的IP地址追踪进行规则的匹配

detection_filter

因为它在达到初始阈值后为每个规则匹配生成警报，其中后者将重置其内部计数器，并在再次达到阈值时再次发出警报，下面的例子表示，2秒的时间内匹配到15次则触发一次警报，然后把计数归零，再次达到15次以后再次触发警报

alert http $EXTERNAL_NET any -> $HOME_NET any \
     (msg:"ET WEB_SERVER WebResource.axd access without t (time) parameter - possible ASP padding-oracle exploit"; \
     flow:established,to_server; content:"GET"; http_method; content:"WebResource.axd"; http_uri; nocase;          \
     content:!"&t="; http_uri; nocase; content:!"&amp|3b|t="; http_uri; nocase;                                    \
     detection_filter:track by_src,count 15,seconds 2;                                                             \
     reference:url,netifera.com/research/; reference:url,www.microsoft.com/technet/security/advisory/2416728.mspx; \
     classtype:web-application-attack; sid:2011807; rev:5;)

suppress

Suppressions 可用于抑制规则或主机/网络的警报

suppress gen_id <gid>, sig_id <sid>
suppress gen_id <gid>, sig_id <sid>, track <by_src|by_dst>, ip <ip|subnet>

这将确保规则2002087永远不会匹配src主机209.132.180.67

suppress gen_id 1, sig_id 2002087, track by_src, ip 209.132.180.67

也可以在threshold.config配置文件中匹配全局生效的抑制信息