Settings

The Settings page allows administrators to control global behaviors of Suricatavel. It is divided into two main sections: General and Integrations.

General configuration

Enrichment settings

Control how Suricatavel enriches alert data with external intelligence.

• Enabled: Global toggle for the enrichment engine.
• Auto-Extract IOCs: Automatically parse IPs, Domains, and URLs from alert payloads.

  Tip

  Enable Auto-Extract IOCs to automate the creation of Indicators of Compromise from your alerts, saving manual triage time.

• Notification Digest: Group enrichment results into summary notifications instead of sending one per alert.
• Cooldown: Minimum seconds between enrichment attempts for the same artifact to prevent API quota exhaustion.

Data retention

Manage how long historical data is kept to optimize storage.

• Exports cleanup: Automatically delete generated export files.
• Host metrics: Days to keep CPU/RAM usage data for Suricata nodes (Default: 7).
• Firewall metrics: Days to keep telemetry for firewalls (Default: 7).

Global Notifications

Configure the channels used for system-wide alerts.

• Database: In-app notifications (Always enabled).
• Mail: Send alerts via email. Requires SMTP configuration.
• Slack: Send alerts to a Slack Webhook.
• Telegram: Send alerts to a Telegram Chat ID.

SIEM Forwarding

Configure destinations to forward your Suricata alerts and events.

• SIEM Outputs: Set up TCP, TCP+TLS, UDP, or HTTPS-based (Splunk HEC) outputs.
• Forwarding Mode: Choose between Global (forward all matching events automatically) or Policy (only forward when triggered by a policy action).
• Include Enrichment: Optionally package rich threat intelligence metadata (Censys, Shodan, etc.) alongside the forwarded event payload.
• Wait for Enrichment: When enabled, the forwarder will delay sending logs until enrichment data is fetched, ensuring downstream systems receive fully decorated alerts.
• Timeout: The maximum seconds to wait for enrichment before sending the event anyway (defaults to 120 seconds).

Integrations

Configure external providers to enhance threat intelligence. Each provider can be independently enabled and rate-limited.

Supported providers

Provider	Type	API key required?	Description
VirusTotal	Malware/Reputation	Yes	Checks file hashes, domains, and IPs against antivirus engines.
AbuseIPDB	IP reputation	Yes	Crowdsourced IP abuse reporting.
Shodan	IoT/Scanner	Yes	Search engine for Internet-connected devices.
Whois	Domain info	No	Retrieves domain registration information.
GeoIP	Geolocation	Yes (License)	Maps IP addresses to physical locations (MaxMind).
UrlHaus	Malware URLs	No	Database of malicious URLs from Abuse.ch.
Censys	Attack Surface	Yes	Analyzes host services, open ports, and SSL/TLS certificates.
AlienVault OTX	Threat Feed	Yes	Leverages open threat exchange pulses and IOC categorization.
GreyNoise	Internet Noise	Yes	Distinguishes between mass-internet scanner traffic and targeted attacks.

Configuration

For each provider, you can configure:

1. API key: Your personal or enterprise access key.
2. Plan: Select your subscription tier (e.g., Free, Premium) to automatically apply correct rate limits.
3. Rate windows: Custom rate limits (Requests per Minute/Hour/Day) to match your quota.

Caution

Rate limits: Suricatavel strictly respects the configured rate limits to avoid getting your API keys banned. Ensure your Plan selection matches your actual subscription.

Transport & TLS Settings (SIEM)

When defining a SIEM output, you can configure secure transmissions under the TLS settings section:

• Protocol: Standard TCP, encrypted TCP+TLS, UDP, or Splunk HTTPS HEC.
• Verify peer: When active, strictly verifies the destination’s SSL certificate against known authorities.
• Allow self-signed: Permits connections using self-signed certificates (ideal for internal dev/staging environments).
• Client credentials: Securely upload client certificates (.crt/.pem) and client keys (.key/.pem) stored in encrypted vault formats.