20ebe7240e
Nouvelles vues de détection (sql/views.sql) : - Identification hosts par IP/JA4 (view_host_identification, view_host_ja4_anomalies) - Détection brute force POST et query params variables - Header fingerprinting (ordre, headers modernes manquants, Sec-CH-UA) - ALPN mismatch detection (h2 déclaré mais HTTP/1.1 parlé) - Rate limiting & burst detection (50 req/min, 20 req/10s) - Path enumeration/scanning (paths sensibles) - Payload attacks (SQLi, XSS, path traversal) - JA4 botnet detection (même fingerprint sur 20+ IPs) - Correlation quality (orphan ratio >80%) ClickHouse (sql/init.sql) : - Compression ZSTD(3) sur champs texte (path, query, headers, ja3/ja4) - TTL automatique : 1 jour (raw) + 7 jours (http_logs) - Paramètre ttl_only_drop_parts = 1 Shutdown simplifié (internal/app/orchestrator.go) : - Suppression ShutdownTimeout et logique de flush/attente - Stop() = cancel() + Close() uniquement - systemd TimeoutStopSec gère l'arrêt forcé si besoin File output toggle (internal/config/*.go) : - Ajout champ Enabled dans FileOutputConfig - Le sink fichier n'est créé que si enabled && path != '' - Tests : TestValidate_FileOutputDisabled, TestLoadConfig_FileOutputDisabled RPM packaging (packaging/rpm/logcorrelator.spec) : - Changelog 1.1.18 → 1.1.22 - Suppression logcorrelator-tmpfiles.conf (redondant RuntimeDirectory=) Nettoyage : - idees.txt → idees/ (dossier) - Suppression 91.224.92.185.txt (logs exemple) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
93 lines
2.7 KiB
YAML
93 lines
2.7 KiB
YAML
# logcorrelator configuration file
|
|
# Format: YAML
|
|
|
|
# Logging configuration
|
|
log:
|
|
level: INFO # DEBUG, INFO, WARN, ERROR
|
|
|
|
inputs:
|
|
unix_sockets:
|
|
- name: http
|
|
source_type: A
|
|
path: /var/run/logcorrelator/http.socket
|
|
format: json
|
|
socket_permissions: "0666" # world read/write
|
|
- name: network
|
|
source_type: B
|
|
path: /var/run/logcorrelator/network.socket
|
|
format: json
|
|
socket_permissions: "0666"
|
|
|
|
outputs:
|
|
file:
|
|
enabled: true
|
|
path: /var/log/logcorrelator/correlated.log
|
|
|
|
clickhouse:
|
|
enabled: false
|
|
dsn: clickhouse://user:pass@localhost:9000/db
|
|
table: correlated_logs_http_network
|
|
batch_size: 500
|
|
flush_interval_ms: 200
|
|
max_buffer_size: 5000
|
|
drop_on_overflow: true
|
|
async_insert: true
|
|
timeout_ms: 1000
|
|
|
|
stdout:
|
|
enabled: false
|
|
|
|
correlation:
|
|
# Time window for correlation (A and B must be within this window)
|
|
# Increased to 10s to support HTTP Keep-Alive scenarios
|
|
time_window:
|
|
value: 10
|
|
unit: s
|
|
|
|
# Orphan policy: what to do when no match is found
|
|
orphan_policy:
|
|
apache_always_emit: true # Always emit A events, even without B match
|
|
apache_emit_delay_ms: 500 # Wait 500ms before emitting as orphan (allows B to arrive)
|
|
network_emit: false # Never emit B events alone
|
|
|
|
# Matching mode: one_to_one or one_to_many (Keep-Alive)
|
|
matching:
|
|
mode: one_to_many
|
|
|
|
# Buffer limits (max events in memory)
|
|
buffers:
|
|
max_http_items: 10000
|
|
max_network_items: 20000
|
|
|
|
# TTL for network events (source B)
|
|
# Increased to 120s to support long-lived HTTP Keep-Alive sessions
|
|
ttl:
|
|
network_ttl_s: 120
|
|
|
|
# Exclude specific source IPs or CIDR ranges from correlation
|
|
# Events from these IPs will be silently dropped (not correlated, not emitted)
|
|
# Useful for excluding health checks, internal traffic, or known bad actors
|
|
exclude_source_ips:
|
|
- 10.0.0.1 # Single IP
|
|
- 192.168.1.100 # Another single IP
|
|
- 172.16.0.0/12 # CIDR range (private network)
|
|
- 10.10.10.0/24 # Another CIDR range
|
|
|
|
# Restrict correlation to specific destination ports (optional)
|
|
# If non-empty, only events whose dst_port matches one of these values will be correlated
|
|
# Events on other ports are silently ignored (not correlated, not emitted as orphans)
|
|
# Useful to focus on HTTP/HTTPS traffic only and ignore unrelated connections
|
|
# include_dest_ports:
|
|
# - 80 # HTTP
|
|
# - 443 # HTTPS
|
|
# - 8080 # HTTP alt
|
|
# - 8443 # HTTPS alt
|
|
|
|
# Metrics server configuration (optional, for debugging/monitoring)
|
|
metrics:
|
|
enabled: false
|
|
addr: ":8080" # Address to listen on (e.g., ":8080", "localhost:8080")
|
|
# Endpoints:
|
|
# GET /metrics - Returns correlation metrics as JSON
|
|
# GET /health - Health check endpoint
|