Intrusion Prevention System

STATE: unstable

API Docs: IDS

Service Docs: Intrusion Prevention System

Definition

For basic parameters see: Basic

ansibleguy.opnsense.ids_action

Definition
Parameter	Type	Required	Default	Aliases	Comment
action	string	true	-	do, a	Action to execute. One of: ‘get_alert_info’, ‘get_alert_logs’, ‘query_alerts’, ‘status’, ‘reconfigure’, ‘restart’, ‘start’, ‘stop’, ‘drop_alert_log’, ‘reload_rules’, ‘update_rules’. These ones return information: ‘get_alert_info’, ‘get_alert_logs’, ‘query_alerts’, ‘status’
alert_id	string	false	-	alert	Parameter Alert-ID needed for ‘get_alert_info’

ansibleguy.opnsense.ids_general

Interfaces for ‘ids_general’ must be provided as used in the network config (p.e. ‘opt1’ instead of ‘DMZ’)

Definition
Parameter	Type	Required	Default	Aliases	Comment
interfaces	list	true	-	ints	Select interface(s) to use. When enabling IPS, only use physical interfaces here (no vlans etc)
enabled	boolean	false	true	-	Enable intrusion detection system
block	boolean	false	false	protection, ips	Enable protection mode (block traffic). Before enabling, please disable all hardware offloading first in advanced network!
promiscuous	boolean	false	-	physical, vlan	For certain setups (like IPS with vlans), this is required to actually capture data on the physical interface
default_packet_size	int	false	(system default)	packet_size	With this option, you can set the size of the packets on your network. It is possible that bigger packets have to be processed sometimes. The engine can still process these bigger packets, but processing it will lower the performance. Unset = system default
local_networks	list	false	[‘192.168.0.0/16’, ‘10.0.0.0/8’, ‘172.16.0.0/12’]	home_networks	Networks to interpret as local
pattern_matcher	string	false	(system default)	algorithm, matcher, algo	One of: ‘ac’, ‘ac-bs’, ‘ac-ks’, ‘hs’. Select the multi-pattern matcher algorithm to use. Options: unset = system default, ‘ac’ = ‘Aho-Corasick’, ‘ac-bs’ = ‘Aho-Corasick, reduced memory implementation’, ‘ac-ks’ = ‘Aho-Corasick, Ken Steele variant’, ‘hs’ = ‘Hyperscan’
profile	string	false	(system default)	detect_profile	One of: ‘low’, ‘medium’, ‘high’, ‘custom’. The detection engine builds internal groups of signatures. The engine allow us to specify the profile to use for them, to manage memory on an efficient way keeping a good performance. Unset = system default
profile_toclient_groups	integer	true if profile = ‘custom’	-	toclient_groups	Between 0 and 65535. If Custom is specified. The detection engine tries to split out separate signatures into groups so that a packet is only inspected against signatures that can actually match. As in large rule set this would result in way too many groups and memory usage similar groups are merged together
profile_toserver_groups	integer	true if profile = ‘custom’	-	toserver_groups	See ‘profile_toclient_groups’
schedule	string	false	‘ids rule updates’	update_cron	Name/Description of an existing cron-job that should be used to update IDS
syslog_alerts	boolean	false	-	syslog, log	Send alerts to system log in fast log format. This will not change the alert logging used by the product itself
syslog_output	boolean	false	-	log_stdout	Send alerts in eve format to syslog, using log level info. This will not change the alert logging used by the product itself. Drop logs will only be send to the internal logger, due to restrictions in suricata
log_level	string	false	(system default)	-	One of: ‘info’, ‘perf’, ‘config’, ‘debug’. Increase the verbosity of the Suricata application logging by increasing the log level from the default. Unset = system default
log_retention	integer	false	4	log_count	Number of logs to keep
log_payload	boolean	false	-	log_packet	Send packet payload to the log for further analyses
log_rotate	string	false	weekly	-	One of: ‘weekly’, ‘daily’. Rotate alert logs at provided interval
reload	boolean	false	true	-	If the running config should be reloaded on change - this may take some time. For mass-managing items you might want to reload it ‘manually’ after all changes are done => using the ansibleguy.opnsense.reload module.

ansibleguy.opnsense.ids_ruleset

The reload action will download/update the rulesets. If modifying multiple ones in a loop you might want to disable it on single calls.

Definition
Parameter	Type	Required	Default	Aliases	Comment
name	string	true	-	description, desc	Name of the ruleset you want to modify. Will show a list of existing ones if an invalid one is supplied!
enabled	boolean	false	true	-	En- or disable the ruleset
reload	boolean	false	true	-	If the running config should be reloaded on change - this may take some time. For mass-managing items you might want to reload it ‘manually’ after all changes are done => using the ansibleguy.opnsense.reload module.

ansibleguy.opnsense.ids_rule

Definition
Parameter	Type	Required	Default	Aliases	Comment
sid	integer	true	-	id	Unique signature-ID of the rule you want to modify
action	string	false	alert	a	One of ‘alert’, ‘drop’. Set action to perform here, only used when in IPS mode
enabled	boolean	false	true	-	En- or disable the rule
reload	boolean	false	true	-	If the running config should be reloaded on change - this may take some time. For mass-managing items you might want to reload it ‘manually’ after all changes are done => using the ansibleguy.opnsense.reload module.

ansibleguy.opnsense.ids_user_rule

Definition
Parameter	Type	Required	Default	Aliases	Comment
name	string	true	-	description, desc	Unique rule name
source_ip	string	false	-	source, src_ip, src	Set the source IP or network to match. Leave this field empty for using ‘any’
destination_ip	string	false	-	destination, dst_ip, dst	Set the destination IP or network to match. Leave this field empty for using ‘any’
ssl_fingerprint	string	false	-	fingerprint, ssl_fp	The SSL fingerprint, for example: ‘B5:E1:B3:70:5E:7C:FF:EB:92:C4:29:E5:5B:AC:2F:AE:70:17:E9:9E’
action	string	false	alert	a”	One of ‘alert’, ‘drop’, ‘pass’. Set action to perform here, only used when in IPS mode
bypass	boolean	false	false	bp	Set bypass keyword. Increases traffic throughput. Suricata reads a packet, decodes it, checks it in the flow table. If the corresponding flow is local bypassed then it simply skips all streaming, detection and output and the packet goes directly out in IDS mode and to verdict in IPS mode
enabled	boolean	false	true	-	En- or disable the rule
reload	boolean	false	true	-	If the running config should be reloaded on change - this may take some time. For mass-managing items you might want to reload it ‘manually’ after all changes are done => using the ansibleguy.opnsense.reload module.

ansibleguy.opnsense.ids_policy

Definition
Parameter	Type	Required	Default	Aliases	Comment
name	string	true	-	description, desc	Unique policy name
priority	integer	false	0	prio	Policies are processed on a first match basis a lower number means more important
rulesets	list	false	-	rs	Rulesets this policy applies to (all when none selected). Rulesets must be enabled beforehand!
action	list	false	-	a	One or multiple of: ‘disable’, ‘alert’, ‘drop’. Rule configured action
new_action	string	false	alert	na	One or multiple of: ‘default’, ‘disable’, ‘alert’, ‘drop’. Action to perform when filter policy applies
rules	dictionary	false	-	-	Key-value pairs of policy-rules as provided by the enabled rulesets. Values must be string or lists. Example: ‘{rules: {signature_severity: [Minor, Major], tag: Dshield}}’
enabled	boolean	false	true	-	En- or disable the Policy
reload	boolean	false	true	-	If the running config should be reloaded on change - this may take some time. For mass-managing items you might want to reload it ‘manually’ after all changes are done => using the ansibleguy.opnsense.reload module.

ansibleguy.opnsense.ids_policy_rule

Definition
Parameter	Type	Required	Default	Aliases	Comment
sid	integer	true	-	id	Unique signature-ID of the rule you want to match
action	string	false	alert	a	One of: ‘alert’, ‘drop’. Rule configured action
enabled	boolean	false	true	-	En- or disable the rule
reload	boolean	false	true	-	If the running config should be reloaded on change - this may take some time. For mass-managing items you might want to reload it ‘manually’ after all changes are done => using the ansibleguy.opnsense.reload module.

Info

Warning

The list module will not return all details of the existing entries as the current implementation does not scale well.

Examples