In this demo,
let's check out how to assess configuration of sensor
and the server components in Maltrail.
So here we are inside the Ubuntu shell of our instance.
And now, let's check out that file, maltrail.conf, where we have our server,
as well as sensor configurations.
So here is the file maltrail.conf.
Let's try and open it.
Let's scroll down a bit and visit the sensor section first,
and then we'll come to the server section,
which is at the top.
So if you scroll down a bit, you'll see the sensor section.
Here, if option USE_MULTIPROCESSING is set to true,
then all CPU cores will be used.
One core will be used only for packet capture,
while other cores will be used for packet processing.
Otherwise, everything will be run on a single core.
Option USE_FEED_UPDATES can be used to turn off the
trail updates from feeds altogether.
Option UPDATE_PERIOD contains the number of seconds
between each automatic trail's update.
CUSTOM_TRAILS_DIR can be used by user to provide location of
directory containing the custom trails files.
Option USE_HEURISTICS turns on heuristic mechanisms,
example long domain name, excessive no such domain name that is suspicious,
direct.exe download, which is against a suspicious,
which is potentially introducing false positives.
Here,
option CAPTURE_BUFFER presents our total memory that is in bytes of
percentage of total physical memory to be used in case of
multiprocessing mode for storing packet capture in a ring buffer for
further processing by non‑capturing process.
Option MONITOR_INTERFACE should contain the name of the capturing interface.
Use value any to capture from all interfaces.
Option CAPTURE_FILTER should contain the network capture.
Let us dc down filter to skip the un interesting
packets and ease the capturing process.
Option SENSOR_NAME contains the name that should be appearing inside the events,
SENSOR_NAME value,
so the event from one sensor could be distinguished from the other.
Here, if option LOG_SERVER is set,
then all events are being sent remotely to the server.
Otherwise, they are stored directly into the logging directory,
set with option LOG_DIR.
Options SYSLOG_SERVER and LOGSTASH_SERVER can be used to send sensor events,
that is logged data, to non‑Mailtrail servers.
In case of syslog server, event data will be sent in CEF,
that is common event format, to UDP.
Example, syslog servers listening at given address.
While in case of Logstash server event,
data will be sent in JSON format to UDP service listening at the given address.
Now, let's go to the server section.
Option HTTP_ADDRESS contains the web server's listening address.
Option HTTP_PORT contains the web server's listening port.
Default listening port is set to 8338.
If option USE_SSL is set to true,
then SSL/TLS will be used for accessing the web server.
For example, instead of HTTP, we'll be using HTTPS.
Over here,
option FAIL2BAN_REGEX contains the regular expression to be used in fail2ban
web calls for the extraction of today's attacker source IPs.
This allows the usage of IP‑blocking mechanisms by periodic pulling
of blacklisted IP addresses from remote location.
Here, option USE_SERVER_UPDATE_TRAILS is set to true.
It will automatically update the trails from trail definitions.
Its basic function is to store the log entries inside the logging
directory and provide the web‑reporting interface for presenting
those same entries to the end user.