Always log Suricata signature id in Network Firewall flow logs

Question

Hello,

Are there any way to log Suricata signature id in Network Firewall netflow logs, not only alert logs?

I've a use case that to review the existing firewall rules and find the outdated rules. This could be easier to findout.

Regards,
Worapoj

Answer

A single flow id or network traffic conversation can indeed match several Suricata FW rules (signature id), so based on that, I think this is why no information about signature id is included in the flow log.

To help identifying unused signature ids, I suggest leveraging alert rules and perhaps use statistics to find unused ones. For instance, in cloudwatch logs you can obtain statistics on alert/drop rules as follows:

```
stats count(*) by event.alert.signature_id
| sort by event.alert.signature_id asc 
```

This assumes that pass rules under study are prepended with equivalent alert rules.

Always log Suricata signature id in Network Firewall flow logs

Relevant content