AlmaLinux10.0 : Suricata , SNORT3

 Suricata

SURICATA IDS/IPS is an open source IDS that monitors communications on the network and detects suspicious traffic.
The basic mechanism is signature-based, so it can detect predefined unauthorized communications. Suricata is also characterized by its ability to provide protection as well as detection.

1.Suricata Installation and Configuration

①Suricata Install

②Determine interface and IP address where Suricata will inspect network packets

③Edit configuration file

④Suricata rules update

⑤Activate Suricata

⑥Confirm Suricata startup

Check Log

Check the stats.log file for statistics (updated every 8 seconds by default)

A more advanced output, EVE JSON, can be generated with the following command

3.Suricata Testing

①Run ping test with curl utility

②Check the alert log to see if it has been logged

4.Setting Suricata Rules

①Display of rule sets packaged in Suricata

②Index list of sources providing rule sets

③Enable source (if et/open is enabled)

Perform update

Restart Suricata service

5.Creating Suricata Custom Rules

①Create files containing customer rules

②Edit configuration file (define new rule paths)

 ③Testing the configuration file

Restart Suricata service

④Testing the application of Custom Rules
Ping another device on the same local network to see if it was logged

To get logs in JSON format, install jq on your system

Execute the following command to ping another device on the same local network

SNORT3

Snort is an open source network intrusion detection system capable of performing real-time traffic analysis and packet logging on IP networks。

It can perform “protocol analysis,” “content search,” and “matching,” and can be used to detect various attacks such as “buffer overflows,” “stealth port scans,” “CGI attacks,” “SMB probes,” “OS fingerprinting attempts,” “semantic URL attacks,” and “server message block probes. The system can be used to detect a variety of attacks, such as

1.advance preparation

1.1 Installing Required Packages

1.Installing openssl-devel

2.Installing cmake

1.2 Install required packages

1.3 Installing LibDAQ

1.4 Installing Optional Packages

1.Installation of LZMA and UUID

2.Installing Tcmalloc

2. Installing Snort3

Running configure

Version Check

test run

Network interface settings

Check network interface

The network interface name is ens160

Set the network interface to promiscuous mode. This way, the network device can capture and inspect all network packets.

Check settings

Check the offload status of the network interface.
If you need to monitor network traffic on an interface, you must disable offloading

LRO and GRO offload status is in off state

Create systemd service for snort network interface

systemd daemon applies changes

Check Snort NIC Service Status

Added Snort Community Ruleset

1.Create a folder for Snort rules, download the community ruleset from the Snort website, and place it in the designated rules directory

2.Edit Snort main configuration file

3.Test Snort's main configuration changes

Add custom rule

1.Create a file in the Snort rules directory

2.Edit Snort main configuration file
Edit Snort main configuration file to include custom rules file directory in main configuration

3.Test Snort's main configuration changes

Install OpenAppID extension

Once the OpenAppID extension is installed, Snort can detect network threats at the application layer level

1.OpenAppID Extension Download and Deployment

2.Copy the extracted folder (odp) to the following directory

3.Edit the Snort main configuration file to define the location of the OpenAppID folder

4.Test Snort's main configuration changes

Verify that all configurations are set up correctly

Send a ping command from a remote computer to the IP address of the server. This will cause an alert log to appear in the console window of the host server

Configure Snort systemd service

1.Creating Users for the Snort Service

2.Create log folder and set permissions
Create directory folder for Snort logs and set folder permissions

3.Create Systemd service file

Reload and activate the Snort service.

Launched Snort service

Check Status

Snort IDS Logging

1.Configure Snort JSON logging

2.Restart Snort

3.Check log files
Ping command from a remote computer to the server, stored in the Snort alert_json.txt file.

This completes the installation and configuration of Snort 3.