Debian packaging

Author: esther

admin/index.yaml

@@ -0,0 +1,19 @@
+files:
+  - src: suricata.yaml
+    dst: /etc/suricata/suricata.yaml
+    variables:
+      - name: ISOLATED_NETWORK
+        type: cidr_network
+      - name: ISOLATED_INTERFACE
+    actions:
+      # FIXME: Check what happens when it's conditionally-skipped.
+      #        Also, try-restart exists.
+      # https://github.com/PiRogueToolSuite/pirogue-admin/issues/17
+      - systemctl restart suricata
+  - src: mongoose.yaml
+    dst: /etc/mongoose/mongoose.yaml
+    variables:
+      - name: ISOLATED_INTERFACE
+    actions:
+      - systemctl restart mongoose 
+

admin/mongoose.yaml

@@ -0,0 +1,45 @@
+configuration:
+  database_path: "/var/lib/mongoose/mongoose.db"
+  extra_configuration_dir: "/var/lib/mongoose/"
+
+  history:
+    max_duration_days: 14  # keep records during 14 days
+
+  collector:
+    suricata:
+      socket_path: "/run/suricata.socket"
+      collect_alerts: true
+      collect_netflow: false
+      enable: true
+
+    nf_stream:
+      interface: "@ISOLATED_INTERFACE@"
+      active_timeout: 30  # 30 seconds
+      enable: true 
+
+  enrichment:
+    geoip:
+      enable: true
+
+  forwarder:
+    discord:
+      - url: https://discord.com/api/webhooks/...
+        username: mongoose-bot
+        avatar_url: https://example.org/avatar.png
+        allowed_mentions:
+          parse: [ ]
+        enable: false
+
+    webhooks:
+      - url: https://example.org/hook
+        headers:
+          X-API-Key: secret
+        auth_type: header
+        auth_token: s3cr3t
+        auth_header_name: X-API-Key
+        verify_ssl: true
+        retry_count: 3
+        retry_delay: 5.0
+        timeout: 10.0
+        topics: ["enriched-network-dpi", "enriched-network-alert"]
+        enable: false