service_manifest.yml

name: Suricata
version: $SERVICE_TAG
description: This service scans network capture files with signature and extract files from network capture.

# Regex defining the types of files the service accepts and rejects
accepts: network/.*
rejects: empty|metadata/.*

# At which stage the service should run (one of FILTER, EXTRACT, CORE, SECONDARY, POST, REVIEW)
# NOTE: Stages are executed in the order defined in the list
stage: CORE
# Which category the service is part of (one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Internet Connected, Networking, Static Analysis)
category: Networking

# Does the service require access to the file to perform its task
# If set to false, the service will only have access to the file metadata (e.g. Hashes, size, type, ...)
file_required: true
# Maximum execution time the service has before it's considered to be timed out
timeout: 180

# is the service enabled by default
enabled: true
privileged: true
uses_temp_submission_data: true

config:
  sure_score: ["MALWARE", "TROJAN", "CURRENT_EVENTS", "CnC", "Checkin"]
  vhigh_score: ["EXPLOIT", "SCAN", "Adware", "PUP"]
  home_net: any
  uses_proxy_in_sandbox: false # Sandbox in Assemblyline is behind a proxy
  suricata_conf: {}

submission_params:
  - default: true
    name: extract_files
    type: bool
    value: true

heuristics:
  - heur_id: 1
    name: Malicious network signature
    score: 1000
    filetype: network/.*
    description: Suricata signature hit with malicious score

  - heur_id: 2
    name: Suspicious network signature
    score: 500
    filetype: network/.*
    description: Suricata signature hit with suspicious score

  - heur_id: 3
    name: Informational network signature
    score: 10
    filetype: network/.*
    description: Suricata basic signature hit

docker_config:
  image: ${REGISTRY}cccs/assemblyline-service-suricata:$SERVICE_TAG
  cpu_cores: 1
  ram_mb: 2048

dependencies:
  updates:
    container:
      allow_internet_access: true
      command: ["python", "-m", "suricata_.update_server"]
      image: ${REGISTRY}cccs/assemblyline-service-suricata:$SERVICE_TAG
      ports: ["5003"]
      cpu_cores: 2
      ram_mb: 4096
    run_as_core: True

update_config:
  generates_signatures: true
  sources:
    - name: emt
      uri: https://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz
    - name: snort3_community
      uri: https://www.snort.org/downloads/community/snort3-community-rules.tar.gz
    - name: urlhaus
      uri: https://urlhaus.abuse.ch/downloads/urlhaus_suricata.tar.gz
  update_interval_seconds: 21600 # Quarter-day (every 6 hours)
  wait_for_update: true