MiracleLinux9.4 ; Suricata Install

 Suricata

SURICATA IDS/IPS is an open source IDS that monitors communications on the network and detects suspicious traffic.
The basic mechanism is signature-based, so it can detect predefined unauthorized communications. Suricata is also characterized by its ability to provide protection as well as detection.

1.advance preparation

Activate the EPEL Repository

System updates

2.Suricata Installation and Configuration

Suricata Install

Determine interface and IP address where Suricata will inspect network packets

Edit configuration file

Suricata rules update

Activate Suricata

Confirm Suricata startup

Check Log

Check the stats.log file for statistics (updated every 8 seconds by default)

A more advanced output, EVE JSON, can be generated with the following command

3.Suricata Testing

Run ping test with curl utility

Check the alert log to see if it has been logged

4.Setting Suricata Rules

Display of rule sets packaged in Suricata

Index list of sources providing rule sets

Enable source (if et/open is enabled)

Perform update

Restart Suricata service

5.Creating Suricata Custom Rules

Create files containing customer rules

Edit configuration file (define new rule paths)

 ③Testing the configuration file

Restart Suricata service

Testing the application of Custom Rules
Ping another device on the same local network to see if it was logged

To get logs in JSON format, install jq on your system

Execute the following command to ping another device on the same local network

Copied title and URL