View Categories

Why Proper Configuration Matters More Than You Think

One of the design principles behind Suri Oculus is that many aspects of its behavior are controlled by a single configuration file. It defines what data is collected, how it is processed, and which features are available through the web interface.

At first glance, most parameters appear straightforward. However, their correct configuration has a direct impact on data quality, analytics, and the overall user experience.

Here are a few sections that deserve special attention.

Network Interfaces #

network_interfaces = ("enp3s0","wlp2s0");

This is one of the most important configuration options.

Suri Oculus uses this list to identify the local network interfaces. If the interface on which Suricata captures traffic is missing from the configuration, some modules will not be able to correctly determine which IP addresses belong to your local network.

In practice, this may result in:

  • devices not appearing in the Network section;

  • incomplete ARP information;

  • missing statistics;

  • incomplete historical data.

This is particularly important on systems using Wi-Fi adapters, VPN interfaces, multiple Ethernet ports, or virtual network interfaces.

After modifying your network configuration, always verify that every required interface is included in the network_interfaces list.

Statistical Events #

statistical_events = ( "tls", "flow", "http" );

Not every Suricata event is equally valuable for long-term statistics.

This parameter determines which event types are used to build charts and collect statistical information.

For example:

  • flow — network connections;

  • http — HTTP traffic;

  • tls — TLS sessions.

Including too many event types can significantly increase processing volume without providing meaningful additional insights.

On the other hand, configuring too few events may result in charts that appear empty even though Suricata is actively processing traffic.

Event Processing List #

keys = (
    "alert",
    "flow",
    "http",
    "dns",
    "dhcp",
    "fileinfo",
    "stats",
    "tls"
);

This list specifies which Suricata event types Suri Oculus retrieves from Redis and processes.

If an event type is missing from this list, it simply will not be processed.

Whenever you modify the Suricata configuration, it is good practice to verify that the generated event types match the configuration used by Suri Oculus.

File Paths #

The configuration also defines the locations of:

  • Suricata rule files;

  • local rules;

  • IOC databases;

  • the GeoLite2 database;

  • fast.log;

  • configuration files such as enable.conf, disable.conf, and drop.conf.

Even a single incorrect path can prevent certain features—such as rule management or geolocation—from functioning correctly.

Sensor Location #

city = "Berlin";
country = "Germany";
latitude = 52.5200;
longitude = 13.4050;

These parameters define the sensor’s location displayed on the map.

If your deployment is located elsewhere, updating these values ensures that the interface accurately reflects the physical location of your sensor.

Final Thoughts #

Most issues related to missing data, incomplete statistics, or unexpected behavior are not caused by software defects—they are caused by configuration.

Before troubleshooting Suri Oculus itself, take a few minutes to verify the following:

  • Are all active network interfaces listed in network_interfaces?

  • Does the keys list match the event types generated by Suricata?

  • Is statistical_events configured appropriately for your environment?

  • Do all referenced files and directories actually exist?

  • Are the rule paths and database locations correct?

A few minutes spent reviewing the configuration can often save hours of troubleshooting later.

In future articles, I’ll take a closer look at each configuration section and explain how it affects the different components of Suri Oculus.