In this demonstration,
we'll take a quick look at the difference in TLS extended logging.
We'll start by opening up the Suricata configuration file in a text editor.
Next, set extended to no under eve‑log, types, tls,
extended. Save the YAML and exit.
You can test the configuration with a ‑T option; otherwise,
restart Suricata for the configuration change to take effect.
Now let's use the replay script to play a pcap that contains a TLS session.
You'll notice that this generates an alert based on a JA3 hash, so let's
look at the rule by grepping on the sid 2028365.
Suricata provides a ja3_hash content modifier to match on a JA3 signature
that is known to be associated with malicious activity.
Now, if we look at TLS events in EveBox,
you'll see that some of the information is undefined.
This is due to the lack of extended logging. Click on the first record. Very
limited information about this TLS session is provided.
Let's re‑enable TLS extended logging and reinvestigate this traffic.
Going back to the Suricata config file, we'll change the
extended value from no back to yes, save the file and exit,
then restart the Suricata service. Once we've given Suricata
a second to catch up, we can go ahead and use our replay
script to replay our demo pcap.
This will generate the same alerts, but now if we look at the TLS records,
we can see that that previously undefined information is now populated.
If we click on the first record,
you'll see that we have a lot more information to include such things as the
JA3 hash. Not only can this information be used for alerts,
but also if you were sending Suricata logs to a SIEM or other workflow
that allows you to use this data for threat hunting or traffic analysis.
You'll also notice that even though we didn't have the JA3 hash logged
through that extended logging,
it was still generated and used for the rule itself.
These are simple changes that can have a significant impact.
You now have a solid basis for working with Suricata's configuration,
and it's time that this section draws to a close.