6.2.1.6. config-files

6.2.1.6.1. Introduction

The config-files command of the show subgroup enables displaying:

• The detailed configuration of the Sigflow detection engine using the config-files suricata-config command

• The rules transmitted by GCenter to the Sigflow engine:

  • rules-scirius: the scirius detection rules

  • rules-files: the file rebuilding rules

  • threshold.

    In this category, the following are defined:

    • alert threshold rules (detection rules)

      For example:
      No more alerts are sent beyond a certain value (notion of limit)
      Or conversely, validate alerts above a certain value (notion of threshold)

    • Limiting detection rules, for example not applying a rule to a specific IP address

It is only possible to display the rules of the configured tenant.

---

6.2.1.6.2. Prerequisites

• Users: setup, gviewadm, gview

• Dependencies:

  • Pair the GCap and GCenter

  • Send rulesets from GCenter to the GCap

---

6.2.1.6.3. Command

show config-files {suricata-config|rules-scirius|rules-files|threshold} [TENANT]

The show config-files command must be followed by:

• The name of the configuration file:

  • suricata-config for the Sigflow configuration

  • rules-scirius for scirius rules for detection used by Sigflow

  • rules-files for file reconstruction rules used by Sigflow

  • threshold for threshold rules, limits, and deletion rules

• The TENANT parameter which can take the following values:

  • Multi-tenant by int: {mon0|mon1|mon2|mon3|monvirt}

  • Multi-tenant by vlan:

    • default

    • VLAN X

    • VLAN X Y

---

6.2.1.6.4. Example to display the scirius rules for detection, in single tenant mode

• Enter the following command.

  (gcap-cli) show config-files rules-scirius
  

• Validate.
  The system displays the result.

  # Rules file for ** generated by Scirius at 2022-05-30 12:41:33.634390+00:00
  
    alert dns any any -> any any (msg:"[ TEST AUTO ] ALERT DNS UDP";sid:12345600;priority:2;)
  

  The file displays:

  • First the generation date

  • Then, in each paragraph, a rule is defined

  For more information on the syntax of the rules, please refer to the GCenter documentation.

---

6.2.1.6.5. Example to display the scirius rules for detection, in multi-tenant mode for the mon0 interface

• Enter the following command.

  (gcap-cli) show config-files rules-scirius mon0
  

• Validate.
  The system displays the result (see example above).

  Note

  If the following message is displayed "Command show config-files rules-scirius mon0 is not recognized", check the configuration (multi-tenant with `mon0` interface).

---

6.2.1.6.6. Example to display the scirius rules in multi-tenant mode for vlan 10

• Enter the following command.

  (gcap-cli) show config-files rules-scirius VLAN 10
  

• Validate.
  The system displays the result (see example above).

  Note

  If the following message is displayed "Command show config-files rules-scirius VLAN 10 is not recognised", check the configuration (multi tenant with VLAN 10).

---

6.2.1.6.7. Example of displaying thresholds, limits, and deletion rules

• Enter the following command.

  (gcap-cli) show config-files threshold
  

• Validate.
  The system displays the result.

    suppress gen_id 1, sig_id 2435, track by_src, ip 10.10.10.10
    threshold gen_id 1, sig_id 2435, type limit, track by_src, count 1, seconds 60)
  

  The file displays:

  • thresholds or limits defined by the keyword "threshold"

  • deletion rules defined by the keyword "suppress"

---