AWS network-firewall documentation change
Summary
Updated Suricata rule examples to use 'alert' modifier in pass rules and corrected documentation links
Security assessment
Demonstrates using 'alert' keyword in pass rules for logging allowed traffic, enhancing security visibility documentation. No specific vulnerability addressed.
Diff
diff --git a/network-firewall/latest/developerguide/suricata-examples.md b/network-firewall/latest/developerguide/suricata-examples.md index 56dbfdcd2..60b4181b0 100644 --- a/network-firewall/latest/developerguide/suricata-examples.md +++ b/network-firewall/latest/developerguide/suricata-examples.md @@ -158 +158 @@ Can be used at the end of a default-deny policy to accurately log the direction -###### Log traffic to an allowed SNI. +###### Log traffic to an allowed SNI @@ -160 +160 @@ Can be used at the end of a default-deny policy to accurately log the direction -These rules log traffic to an allowed SNI. Requires your policy to use strict order rule evaluation order. +The `alert` keyword can be used in the pass rule to generate alert logs for all matches. This rule logs all passed traffic to an allowed SNI. @@ -163,2 +163 @@ These rules log traffic to an allowed SNI. Requires your policy to use strict or - alert tls $HOME_NET any -> $EXTERNAL_NET any (ssl_state:client_hello; tls.sni; content:".example.com"; dotprefix; endswith; nocase; msg:"example.com (http://example.com/) allowed by rule 202307052"; sid:202307051;) - pass tls $HOME_NET any -> $EXTERNAL_NET any (ssl_state:client_hello; tls.sni; content:".example.com"; dotprefix; endswith; nocase; sid:202307052;) + pass tls $HOME_NET any -> $EXTERNAL_NET any (ssl_state:client_hello; tls.sni; content:".example.com"; dotprefix; endswith; nocase; alert; sid:202307052;) @@ -196 +195 @@ The following JSON defines an example Suricata compatible rule group that uses t -The variable `EXTERNAL_NET` is a Suricata standard variable that represents the traffic destination. For more information, see [https://docs.suricata.io/en/suricata-7.0.0/rules/intro.html#ports-source-and-destination](https://docs.suricata.io/en/suricata-7.0.0/rules/intro.html#ports-source-and-destination). +The variable `EXTERNAL_NET` is a Suricata standard variable that represents the traffic destination. For more Suricata-specific information, see the [Suricata documentation](https://docs.suricata.io/en/suricata-7.0.8/).