NAME

Ixchel::Actions::suricata_ouputs - Generate a outputs include for suricata.

VERSION

Version 0.2.0

CLI SYNOPSIS

ixchel -a suricata_outputs [-d <base_dir>] [-i <instance>]

ixchel -a suricata_outputs -w [-d <base_dir>] [-i <instance>] [--np]

CODE SYNOPSIS

    use Data::Dumper;

    my $results=$ixchel->action(action=>'suricata_outputs', opts=>{np=>1, w=>1, });

    print Dumper($results);

DESCRIPTION

The template used is 'suricata_outputs'.

    .suricata.enable_fastlog :: Perl boolean if to enable fastlog output.
        Default ::
        Map To :: .vars.enable_fastlog

    .suricata.enable_syslog :: Perl boolean if to enable syslog output.
        Default :: 0
        Map To :: .vars.enable_syslog

    .suricata.filestore_enable :: Perl boolean if to enable the filestore.
        Default :: 0
        Map To :: .vars.filestore_enable

    .suricata.dhcp_in_alert_eve :: Perl boolean if DHCP type items should be in the alert eve.
        Default :: 0
        Map To :: .vars.dhcp_in_alert_eve

    .suricata.config_base :: The variable used for controlling where the outputs.yaml
            file is created.

    .suricata.enable_pcap_log :: Enable PCAP logging.
        Default :: 0
        Map To :: .vars.enable_pcap_log

The logging options are as below.

    .suricata.logging.in_outputs :: Put the .logging section in the outputs include.
        Default :: 1
        Map To :: .vars.logging.in_outputs

    .suricata.logging.level :: Value for .logging.default-log-level .
        Default :: notice
        Map To :: .vars.logging.level

    .suricata.logging.console :: If enabled should be yes or no for the syslog console output.
        Default :: no
        Map To :: .vars.logging.console

    .suricata.logging.file :: If enabled should be yes or no for the file logging output.
        Default :: yes
        Map To :: .vars.logging.file

    .suricata.logging.file_level :: Value for level for the file output.
        Default :: info
        Map To :: .vars.logging.file_level

    .suricata.logging.syslog :: If enabled should be yes or no for the syslog logging output.
        Default :: no
        Map To :: .vars.logging.syslog

    .suricata.logging.syslog_facility :: Value for facility for syslog logging output.
        Default :: local5
        Map To :: .vars.logging.syslog_facility

    .suricata.logging.syslog_format :: Value for format for syslog logging output.
        Default :: "[%i] <%d> -- "
        Map To :: .vars.logging.syslog_format

Multiinstance handling. Ixchel supports multiple Suricata instances on Linux. If .suricata.multi_instace is set to 1, then the following is done.

    1: Instance vars are generated via first copying the ones above and then
       overwriting them with .suricata.instances.$instance.$var .

    2: .vars.instance_part is set to "-$instance". If instances are not in use
       this value is ''.

    3: .vars.instance_part2 is set to "$instance.". If instances are not in use
       this value is ''.

    4: The output file is named  "outputs-$instance.yaml".

FLAGS

-w

Write the generated services to service files.

-i instance

A instance to operate on.

-d <base_dir>

Use this as the base dir instead of .suricata.config_base from the config.

RESULT HASH REF

    .errors :: A array of errors encountered.
    .status_text :: A string description of what was done and the results.
    .ok :: Set to zero if any of the above errored.