Adding Rulesets

---

Suricata

Suricata Rule Syntax

Official Suricata rule syntax can be found at https://docs.suricata.io/en/suricata-6.0.0/rules/intro.html

1. Browse to the TFPlenum Controller UI page

2. On the left navigation bar, click the Rule Set link

3. Click the Add RuleSet button in the top-right corner and fill the following information, then click Submit:

   Field	Value
   RuleSet Name	Enter an appropriate ruleset name
   Classification	Select the appropriate rule classification
   Rule Type	Suricata
   Sensors	Select all the sensors you want the ruleset applied to
   Is Enabled?	🗹 CHECKED

4. Expand the newly added rule entry and click +Add Rule

5. Enter a rule name where it says Add rule name here. *

6. Paste in the Suricata rule content that you want to add

---

Zeek Intel

Zeek Intel Syntax

• Zeek will generate an Intel log/alert for any given indicator that is found in analyzed network traffic – it can intelligently determine where certain indicator types are expected to be found within different protocol communications.
• The following headers must be the first line of the intel file (meta.* fields are optional but found default in OSINT sources). Each column also must be tab-separated, NOT space separated.

#fields   indicator   indicator_type   meta.source   meta.do_notice   meta.desc

Column	Description
#fields	This is not a column and should be ignored – Zeek uses this internally to identify the column order
indicator	The indicator for Zeek to alert on
indicator_type	The type of indicator
meta.source	What intelligence source provided the indicator
meta.do_notice	Toggles (T or F) whether the event is sent to the Zeek Notice Framework – this has no effect on intel alerting
meta.desc	A description of the indicator

• The Zeek intel framework supports the following intel indicator types (populated in the indicator_type column):

Indicator Type	Description
Intel::ADDR	Single IP Addresses
Intel::SUBNET	IP Subnets
Intel::DOMAIN	Partial, or fully qualified domain names
Intel::EMAIL	Email addresses
Intel::SOFTWARE	Software names
Intel::USER_NAME	Username
Intel::FILE_NAME	Filenames
Intel::URL	URLs
Intel::FILE_HASH	File hashes (MD5/SHA1/SHA256)
Intel::PUBKEY_HASH	Public key hashes (MD5)
Intel::CERT_HASH	Certificate hashes (SHA1)
Intel::JA3	JA3 Hashes

• Example Intel file:

#fields   indicator   indicator_type   meta.source   meta.do_notice   meta.desc
1.1.1.1   Intel::ADDR   AlientVault    Y     This is a bad IP address
/bad.exe  Intel::URL    Unit42         Y     Bad file download
admin     Intel::USER_NAME     CISA    Y     Might flag on HTTP admin logins

1. Browse to the TFPlenum Controller UI page

2. On the left navigation bar, click the Rule Set link

3. Click the Add RuleSet button in the top-right corner and fill the following information, then click Submit:

   Field	Value
   RuleSet Name	Enter an appropriate ruleset name
   Classification	Select the appropriate rule classification
   Rule Type	Zeek Intel
   Sensors	Select all the sensors you want the ruleset applied to
   Is Enabled?	🗹 CHECKED

4. Expand the newly added rule entry and click +Add Rule

5. Enter a rule name where it says Add rule name here. *

6. Paste in the Zeek intel content that you want to add

---

Zeek Signatures

1. Browse to the TFPlenum Controller UI page

2. On the left navigation bar, click the Rule Set link

3. Click the Add RuleSet button in the top-right corner and fill the following information, then click Submit:

   Field	Value
   RuleSet Name	Enter an appropriate ruleset name
   Classification	Select the appropriate rule classification
   Rule Type	Zeek Signatures
   Sensors	Select all the sensors you want the ruleset applied to
   Is Enabled?	🗹 CHECKED

4. Expand the newly added rule entry and click +Add Rule

5. Enter a rule name where it says Add rule name here. *

6. Paste in the Zeek signature content that you want to add

---

Zeek Scripts

1. Browse to the TFPlenum Controller UI page

2. On the left navigation bar, click the Rule Set link

3. Click the Add RuleSet button in the top-right corner and fill the following information, then click Submit:

   Field	Value
   RuleSet Name	Enter an appropriate ruleset name
   Classification	Select the appropriate rule classification
   Rule Type	Zeek Scripts
   Sensors	Select all the sensors you want the ruleset applied to
   Is Enabled?	🗹 CHECKED

4. Expand the newly added rule entry and click +Add Rule

5. Enter a rule name where it says Add rule name here. *

6. Paste in the Zeek script content that you want to add

---