Automated Actions & Policies

Suricatavel includes a Policy Engine to automate threat mitigation and incident response. When security alerts are generated or Indicator of Compromise (IOC) scores change, Suricatavel can execute multiple responses simultaneously—blocking threats at the firewall, raising tickets, and routing events to SIEM pipelines.

---

How policies work

A Policy consists of three core components:

• Triggers: The system event that fires the policy.
  • alert_created: Activates the moment a new Suricata alert is ingested.
  • ioc_score_updated: Activates when an IOC’s reputation score is updated (e.g., via threat intel enrichment).
• Conditions: Filter criteria that must be met (e.g., minimum severity, rule action, or IOC reputation threshold).
• Action configurations: One or more response actions executed sequentially or in parallel.

---

Action types

Each policy can run multiple distinct actions in parallel.

A. Firewall IP Blocking (firewall_block)

Automatically block malicious IPs at the network boundary.

• Target IP selection: Block the source IP, destination IP, or both.
• Direction & zone overrides: Force specific blocking rules (e.g., block inbound, override default interface zones).
• TTL (Time to Live): Define a temporary block (in seconds) or set to 0 for a permanent ban.
• Dry run mode: Safe testing mode that logs the block action in the database and audit trail without pushing the rule to active firewalls.

B. Ticketing & Incident Management (ticketing)

Dispatch detailed alerts to external ticketing tools (Jira, ServiceNow, or custom webhooks).

• Integration: Select one or more configured ticketing channels.
• Templates: Assign a markdown/HTML message template.
• Dynamic variables: Use variables to inject live incident details:

  Incident triggered by Policy: {{ policy_name }} (ID: {{ policy_id }})
  Alert details:
  - Source IP: {{ alert.source_ip }}
  - Target IP: {{ alert.dest_ip }}
  - Signature: {{ alert.signature }}
  - Severity: {{ alert.severity }}

C. SIEM Forwarding (siem_forward)

Directly route matching alert batches to designated SIEM pipelines instead of using global streams.

---

Creating a policy

To create an automated mitigation rule:

1. Log in to Suricatavel.
2. Navigate to Policies in the sidebar and click New policy.
3. Under General information:
   • Give the policy a descriptive name (e.g., Block High Severity SSH Brute Force).
   • Set the Trigger type (e.g., alert_created).
   • Define the Priority (lower numbers execute first).
4. Set Conditions:
   • Select severity thresholds (e.g., Severity >= 3).
   • Filter by Suricata rule actions or alert categories if desired.
5. Apply Safeguards:
   • IP Whitelist: Enter IP ranges (e.g., your gateway or DNS) that must never be blocked.
   • Cooldown: Set the minimum seconds between executions for the same IP (e.g., 3600 seconds to avoid duplicate blocks).
   • Rate Limit: Set the maximum executions allowed per minute to prevent alert fatigue and loop storms.
6. Under Actions, click Add action configuration:
   • Choose firewall_block, configure targets, TTL, select active firewalls, and check Dry Run to verify.
   • Add a second action of type ticketing, choosing your Slack or Jira integration and template.
7. Set the policy status to Enabled and click Save.

---

Built-in safeguards and protection

The Policy engine implements several safety gates:

Safeguard	Target	Description
IP Whitelist	Firewall block	Restricts automated blocks on critical local/internal infrastructure.
Cooldown	All Actions	Prevents spamming blocks/tickets for identical IPs during active attacks.
Rate limiter	All Actions	Throttles executions globally if a rule gets triggered repeatedly.
Dry run toggle	Firewall / Ticket	Simulates blocks/notifications, auditing the logs without active impact.

---

Monitoring policy health

You can track execution trends, failures, and mitigation audits directly in the UI:

• Policy dashboard: View execution counts, average execution times, and trend widgets.
• Execution history: Navigate to Policies > History to view every trigger event, matching state, dry-run reports, and execution errors.