Basic Question regarding logging

Help
1

Please include the following information with your help request:

  • Suricata version
  • Operating system and/or Linux distribution
  • How you installed Suricata (from source, packages, something else)

I have just installed Suricata 8, with the intentions of forwarding logs to Splunk. It sits within the core switch, so has high visibility on the traffic through our network.

Perhaps I’m going about this the wrong way, but currently eve.json is being forwarded to splunk via syslog. but the amount of logs is immense. My hope is to refine what is being logged, but I’m struggling with refining certain things.

I can completely cut out particular event types just fine by removing it within the suricata.yml file. But is it at all possible to get granular within a particular event type. Say for instance, if I want to not log dns traffic between particular end points. I have spent a fair amount of time consulting forums, and also different AI platforms. AI keeps providing suggestions with log spression, or creating local.rules entries that either pass/drop what I want, but the end result is the information still shows up in eve.log after I apply the changes and restart. After quite a bit of back and forth, these AI platforms seem to hint that what I wish to do may not be possible. That you log all dns, or you don’t.

I am using Suricata 8.0.0 running on Ubuntu Server 24.04.3. And I installed it directly thorough apt get repository. Hope this all makes sense?

2

Hello,

I don’t think it’s possible to to filter specific sub-fields of dns (or other EVE fields) unless they’re listed in the suricata.yaml file (if needed, a simple example on how to do that can be seen here: Logging different kind of logs in different EVE files - #2 by syoc)

An alternative that comes to mind would be to filter out certain events to a different eve file. But I’m not sure this would be useful in your case.

I’m not aware of whether how you’re forwarding Suricata logs to Splunk is the best alternative or not (sorry about that bit!)

3

Thanks for the reply! I’m starting to look into ways to manipulate the original eve file into a second file, as you suggested. I’ll wait and see how realistic this is in production, but so far so good. Python script is dropping the IPs and domains I don’t need to see into a secondary file. If it can maintain through the rolling or clearing of the original file as it grows too large, maybe this will work! Thanks again!