# Suricata IDs with CVSS vectors

**URL:** <https://forum.suricata.io/t/suricata-ids-with-cvss-vectors/4854>\
**Category:** Help\
**Tags:** suricata\
**Created:** [September 14, 2024, 2:21am UTC](https://forum.suricata.io/t/suricata-ids-with-cvss-vectors/4854 "2024-09-14T02:21:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wilker\_Luiz\_Gadelha](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/wilker_luiz_gadelha/32/2974_2.png) [@Wilker\_Luiz\_Gadelha](https://forum.suricata.io/u/Wilker_Luiz_Gadelha)\
**Post date:** [September 14, 2024, 2:21am UTC](https://forum.suricata.io/t/suricata-ids-with-cvss-vectors/4854/1 "2024-09-14T02:21:23Z")

</div>

I need to associate CVSS v3/v4 vectors to use as vulnerability and threat metrics in Suricata alert events and I usually find associations with application in CVE IDs. How can I associate the composition of CVSS vectors to Suricata IDs in the 3 metric bases that CVSS uses? could use Suricata ID + severity as strong key for clustering and apply CVSS vectors ? Thank you.

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [September 15, 2024, 2:00pm UTC](https://forum.suricata.io/t/suricata-ids-with-cvss-vectors/4854/2 "2024-09-15T14:00:27Z")

</div>

Many – not all – Suricata rules include CVE references with the rule – in the reference and metadata section.

Here’s an example from the Proofpoint/ET Open (free) Suricata ruleset that shows the CVE reference in the `reference` and `metadata` sections.

```auto
alert udp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (7)"; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"..|5C|..|5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; classtype:attempted-admin; sid:2008696; rev:6; metadata:created_at 2010_07_30, cve CVE_2008_4250, updated_at 2019_07_26;)

```

Here’s another rule that also includes the CVE reference in the rule `msg`:

```auto
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Geoserver Unsafe jxpath Evaluation RCE Attempt M5 (CVE-2024-36401)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/geoserver/w"; fast_pattern; startswith; content:"s?"; distance:1; within:2; content:"valuereference"; nocase; distance:0; content:"exec|28|java.lang.Runtime.getRuntime|28 29 2c|"; nocase; within:40; reference:cve,2024-36401; reference:url,github.com/Mr-xn/CVE-2024-36401?tab=readme-ov-file; classtype:attempted-admin; sid:2055811; rev:1; metadata:affected_product Geoserver, attack_target Server, tls_state plaintext, created_at 2024_09_09, cve CVE_2024_36401, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_09_09; target:dest_ip;)

```

Is this what you’re looking for?

---

<div class="post-metadata">

**Author:** ![Wilker\_Luiz\_Gadelha](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/wilker_luiz_gadelha/32/2974_2.png) [@Wilker\_Luiz\_Gadelha](https://forum.suricata.io/u/Wilker_Luiz_Gadelha)\
**Post date:** [September 15, 2024, 3:43pm UTC](https://forum.suricata.io/t/suricata-ids-with-cvss-vectors/4854/3 "2024-09-15T15:43:21Z")

</div>

Thank you for your attention! It was very useful. However, analyzing a log file of events and with a minimal, basic configuration in suricata.yaml, without the possibility of changing the rules, I do not have the metadata information, but a use case, I would like to try to apply CVSS and by analogy, make some association with CVEs. I would like to adapt CVSS metrics to evaluate these logs. And thinking about accommodating indexing by Suricata ID (SID) + severity, perhaps? more protocol information? and associating it with a grouping to identify summarized sets of alerts by priority, vulnerabilities?

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [September 16, 2024, 12:25pm UTC](https://forum.suricata.io/t/suricata-ids-with-cvss-vectors/4854/4 "2024-09-16T12:25:29Z")

</div>

The default/minimal Suricata configuration doesn’t include the rule metadata in the alert.

Add this snippet to the `alert` section within `outputs`

```auto
      types:
        - alert:

            metadata:
              rule:
                metadata: true

```

You can also make the association with the CVE-related rules by processing the alerts as they contain the signature id and access to the rules file.