Suri Oculus 4.0 Configuration

Suri Oculus 4.0 uses separate configuration files for different system components. The main parameters for Suricata event processing, data storage, HBF (Host Behavior Fingerprinting), network interfaces, rules, and IOC management are defined in the daemonmove and Suri Oculus backend server configuration files.

The configuration files use the libconfig syntax.

1. daemonmove Configuration #

daemonmove is responsible for reading Suricata events from eve.json, processing them, and transferring the data to Redis. In Suri Oculus 4.0, this component also generates HBF data for detected network devices.

Example configuration:

application:
{
    main:
    {
         title = "REDISMOVE";
         version = "4.0.0";
         date = "29 Oct 2025";
    };

    settings:
    {
      main_key = "suricata";
      keys = ("alert", "anomaly", "dcerpc","flow", "http", "dns", "drop",
              "stats_report", "fileinfo", "tls", "stats", "ftp", "sip",
              "smb", "snmp", "ssh", "flow_data", "tftp", "ssh",
              "bittorrent_dht", "rdp", "http2", "pqsql", "quic", "modbus");

      valid_duration = 24;

      log_file = "/var/log/suricata/eve.json";
      temp_file = "/tmp/daemonparser/current";

      sleeping_time = 160;
      lock_expiration_time = 90;

      hbf_networks = (
         "192.168.100.0/24",
         "10.77.38.0/24"
      );

      hbf_device_retention_days = 7;
      hbf_statistics_window_hours = 24;
    };
};

main_key #

main_key = "suricata";

Defines the main prefix (key) used by the component when working with Suricata data in Redis.

keys #

keys = ("alert", "anomaly", "dcerpc", ...);

Defines the list of Suricata event types processed by daemonmove.

The event type is determined by the event_type field in eve.json. Supported events are stored in the corresponding Redis data structures and become available to other Suri Oculus components.

valid_duration #

valid_duration = 24;

Defines the period, in hours, during which processed data is considered valid.

For example:

corresponds to 24 hours.

log_file #

log_file = "/var/log/suricata/eve.json";

Specifies the path to the main Suricata JSON event log.

For a standard Suricata installation, this is usually:

/var/log/suricata/eve.json

temp_file #

temp_file = "/tmp/daemonparser/current";

Specifies the temporary file used by daemonmove during data processing.

sleeping_time #

sleeping_time = 160;

Defines the delay between daemonmove processing cycles.

This parameter should normally be changed only when tuning system performance.

lock_expiration_time #

lock_expiration_time = 90;

Defines the lifetime of the lock used to prevent multiple process instances from processing the same data simultaneously.

2. HBF Configuration #

HBF (Host Behavior Fingerprinting) builds activity profiles for network devices based on Suricata network events.

The following parameters control HBF operation:

hbf_networks = (
    "192.168.100.0/24",
    "10.77.38.0/24"
);

hbf_device_retention_days = 7;
hbf_statistics_window_hours = 24;

hbf_networks #

Defines the networks whose devices should be tracked by HBF.

For example:

hbf_networks = (
    "192.168.100.0/24",
    "10.77.38.0/24"
);

In this configuration, HBF tracks devices belonging to the following two networks:

192.168.100.0/24
10.77.38.0/24

Multiple networks can be specified.

This is particularly useful on Suri Oculus systems with multiple network interfaces or when monitoring several network segments.

hbf_device_retention_days #

hbf_device_retention_days = 7;

Defines how long an inactive device is retained in the HBF database.

For every detected device, HBF stores the time of its most recent activity (last_seen). If the device does not appear in Suricata events for longer than the configured retention period, its information can be removed from HBF storage.

For example:

hbf_device_retention_days = 7;

means that a device that has not been observed on the network for more than 7 days is considered stale and is removed from the HBF device inventory together with its associated HBF data.

Increasing this value allows device history to be retained for a longer period, but also increases the amount of data stored in Redis.

For most installations, the following value is appropriate:

For networks where devices appear only occasionally, the value can be increased, for example:

hbf_device_retention_days = 30;

hbf_statistics_window_hours #

hbf_statistics_window_hours = 24;

Defines the time window used by HBF when calculating device activity statistics.

A value of:

corresponds to a 24-hour statistical window.

This parameter should not be confused with hbf_device_retention_days.

hbf_device_retention_days determines how long a device remains in HBF storage, while hbf_statistics_window_hours determines the time period used to calculate its current activity statistics.

3. Backend Server Configuration #

The Suri Oculus backend provides the REST API used by the web client and performs operations involving Redis, Suricata rules, IOC data, GeoIP, and other data sources.

Example configuration:

application:
{
    main:
    {
        title = "OCULUS SERVER";
        version = "4.0.8";
        date = "14 Nov 2025";
    };
    
    settings:
    {
        main_key = "suricata";

        keys = ("alert", "flow", "http", "dns", "dhcp",
                "fileinfo", "stats", "tls");

        statistical_events = ("tls", "flow", "http");

        valid_duration = 24;

        redis_connect = "redis://127.0.0.1/";

        rules_file = "/var/lib/suricata/rules/suricata.rules";
        tmp_rule_file = "/home/fil/suricata_validate_rule.rules";
        tmp_rule_dir = "/tmp";

        suricata_conf = "/etc/suricata/suricata.yaml";

        additional_rules = "/var/lib/suricata/rules/additional.rules";
        local_rules = "/var/lib/suricata/rules/local.rules";

        disable_conf = "/etc/suricata/disable.conf";
        enable_conf = "/etc/suricata/enable.conf";
        drop_conf = "/etc/suricata/drop.conf";

        ioc_full_link = "https://threatfox.abuse.ch/export/csv/full/";
        ioc_full_file_path = "/var/lib/suricata";
        ioc_full_file_name = "/var/lib/suricata/full.csv";
        ioc_local_file_name = "/var/lib/suricata/ioc.json";

        ioc_domain_rules = "/var/lib/suricata/rules/ioc_domain.rules";
        ioc_url_rules = "/var/lib/suricata/rules/ioc_url.rules";
        ioc_ip_rules = "/var/lib/suricata/rules/ioc_ip.rules";

        ioc_domains_lst = "/var/lib/suricata/ioc_domains.lst";

        fast_file = "/var/log/suricata/fast.log";

        geo_file = "/usr/share/GeoIP/GeoLite2-City.mmdb";

        city = "Berlin";
        country = "Germany";
        latitude = 52.5200;
        longitude = 13.4050;

        network_interfaces = ("enp2s0","enp1s0");
    };
};

4. Main Backend Parameters #

main_key #

main_key = "suricata";

Defines the main key used to access Suricata data stored in Redis.

keys #

keys = ("alert", "flow", "http", "dns", "dhcp",
        "fileinfo", "stats", "tls");

Defines the Suricata event types used by the backend server.

statistical_events #

statistical_events = ("tls", "flow", "http");

Defines the event types for which the backend performs statistical processing.

valid_duration #

valid_duration = 24;

Defines the time range, in hours, during which data is considered current.

redis_connect #

redis_connect = "redis://127.0.0.1/";

Defines the URI used by the backend server to connect to Redis.

For a local Redis installation, the loopback address is used:

127.0.0.1

5. Suricata Rule Files #

rules_file #

rules_file = "/var/lib/suricata/rules/suricata.rules";

Specifies the main Suricata rules file.

tmp_rule_file #

tmp_rule_file = "/home/fil/suricata_validate_rule.rules";

Specifies the temporary file used when validating Suricata rules.

tmp_rule_dir #

tmp_rule_dir = "/tmp";

Specifies the directory used for temporary files.

suricata_conf #

suricata_conf = "/etc/suricata/suricata.yaml";

Specifies the main Suricata configuration file.

additional_rules #

additional_rules = "/var/lib/suricata/rules/additional.rules";

Specifies the file containing additional rules.

local_rules #

local_rules = "/var/lib/suricata/rules/local.rules";

Specifies the file containing local user-defined rules.

disable_conf / enable_conf / drop_conf #

disable_conf = "/etc/suricata/disable.conf";
enable_conf = "/etc/suricata/enable.conf";
drop_conf = "/etc/suricata/drop.conf";

These configuration files are used to control the state of Suricata rules.

They define rules that should be disabled, enabled, or changed to the drop action, respectively.

6. IOC Configuration #

Suri Oculus can use external and local Indicators of Compromise (IOC).

ioc_full_link #

ioc_full_link = "https://threatfox.abuse.ch/export/csv/full/";

Specifies the URL used to download the complete ThreatFox IOC dataset.

ioc_full_file_path #

ioc_full_file_path = "/var/lib/suricata";

Defines the directory used to store downloaded IOC data.

ioc_full_file_name #

ioc_full_file_name = "/var/lib/suricata/full.csv";

Specifies the local file containing the complete IOC dataset.

ioc_local_file_name #

ioc_local_file_name = "/var/lib/suricata/ioc.json";

Specifies the local Suri Oculus IOC file.

IOC Rule Files #

ioc_domain_rules = "/var/lib/suricata/rules/ioc_domain.rules";
ioc_url_rules = "/var/lib/suricata/rules/ioc_url.rules";
ioc_ip_rules = "/var/lib/suricata/rules/ioc_ip.rules";

These files contain automatically generated Suricata rules for different IOC types:

ioc_domain.rules — domain names;
ioc_url.rules — URLs;
ioc_ip.rules — IP addresses.

ioc_domains_lst #

ioc_domains_lst = "/var/lib/suricata/ioc_domains.lst";

Specifies the domain list used by the IOC subsystem.

7. Fast Log #

fast_file = "/var/log/suricata/fast.log";

Specifies the path to the Suricata fast.log file.

The backend uses this file to provide Fast Log data through the Suri Oculus interface.

8. GeoIP and System Location #

geo_file #

geo_file = "/usr/share/GeoIP/GeoLite2-City.mmdb";

Specifies the path to the MaxMind GeoLite2 City database.

The database is used to determine the geographical location of IP addresses.

city, country, latitude, longitude #

city = "Berlin";
country = "Germany";
latitude = 52.5200;
longitude = 13.4050;

These parameters define the physical or logical location of the Suri Oculus installation.

The values should be changed according to the location of the particular Suri Oculus system.

9. Network Interfaces #

network_interfaces = ("enp2s0","enp1s0");

The network_interfaces parameter defines the network interfaces belonging to the host on which Suri Oculus is running.

The list should contain the interfaces associated with the Suri Oculus system and used when identifying the server’s own network addresses.

For example:

network_interfaces = ("enp2s0","enp1s0");

means that the Suri Oculus server has two network interfaces that should be taken into account:

enp2s0
enp1s0

This is particularly important on servers with multiple network adapters. For example, one interface may be used for system management while another is connected to the monitored network segment.

Network interface names can be determined with:

ip link

or:

ip addr

The required interfaces can then be specified in the configuration:

network_interfaces = (
    "enp1s0",
    "enp2s0",
    "enp3s0"
);

If network interface names are changed in the operating system, the corresponding values must also be updated in the Suri Oculus configuration.

10. Applying Configuration Changes #

After modifying the configuration files, restart the corresponding Suri Oculus services.

When changing daemonmove parameters, restart the daemonmove service.

When changing backend configuration parameters, restart the Suri Oculus backend service.

Before restarting a service, it is recommended to verify the configuration file syntax. A libconfig syntax error may prevent the corresponding Suri Oculus component from starting.

Updated on September 30, 2026