MLPAB-2575 - use tls rules to make an allow list

[andrewpearce-digital]

Purpose

Only allow network egress to services we use

Fixes MLPAB-2575

Approach

• add tls rules
• set drop rules to alert mode
• upgrade network module to add log insight query

Learning

• https://docs.aws.amazon.com/network-firewall/latest/developerguide/rule-group-stateful-creating.html
• https://docs.suricata.io/en/latest/rules/http-keywords.html
• https://docs.suricata.io/en/latest/rules/tls-keywords.html
• https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-examples.html#suricata-example-domain-filtering

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.04%. Comparing base (816d7bd) to head (aba8ace).
Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1720   +/-   ##
=======================================
  Coverage   95.04%   95.04%           
=======================================
  Files         285      285           
  Lines       16452    16452           
=======================================
  Hits        15637    15637           
  Misses        644      644           
  Partials      171      171           

Flag	Coverage Δ
unittests	95.04% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[acsauk]