ArchLinux : Suricata+ELK+Kibana+Beats

Prerequisites

1.Suricata
Suricata IDS/IPS is an open-source intrusion detection system (IDS) that monitors network traffic and detects suspicious activity. Since it operates on a signature-based mechanism, it can detect predefined malicious traffic. Another key feature of Suricata is its ability to not only detect but also prevent such threats.

2.Elastic Stack,Kibana,Filebeat
Install and configure the Elastic Stack to enable visualization and search of SURICATA logs using Kibana and Filebeat

In this session, we will install Suricata IDS and ElasticStack on the following server
・First server　Suricata IDS & Filebeat　: ArchLinux IP address(192.168.11.83)
・Second server　ElasticStack & kibana　: Debian13.x IP address(192.168.11.85)
This time, we will run it as the root user

 Server 1: Suricata Installation

1.Installing and Configuring Suricata

①Install

➁Checking and Loading Required Kernel Modules
To use NFQUEUE, the kernel must support nfnetlink_queue.
Module Verification:

If nothing appears above, load the module

Confirm again

Keep this setting active even after a restart

➂Determine the interfaces and IP addresses that Suricata uses to inspect network packets

④Edit the configuration file

Set directory ownership and execution permissions

⑤Starting Suricata

⑥Verifying that Suricata is running

Check the log

To view the statistics, check the stats.log file (updated every 8 seconds by default)

EVE JSON, which provides more advanced output, can be generated using the following command

2.Testing Suricata

①Temporarily disable nfqueue mode

➁Run a ping test using the curl utility

➂Check the log file using the specified rule number
Suricata comes with the following two log files, which are enabled by default.

/var/log/suricata/fast.log
/var/log/suricata/eve.log
To check the log entries corresponding to curl requests, use the grep command to examine the /var/log/suricata/fast.log file.2100498
 Search for log entries using rule identifiers. (For IPv4)

 ④Check the events in /var/log/suricata/eve.log

Install jq

Search for signature 2100498 to filter events in the EVE log
Display the alert object with the signature_id key that matches the value 2100498

3.Configuring Suricata Rules

①Displaying the rule sets included in Suricata

②List of indexes for sources that provide rule sets

③Enable the source (if enabling tgreen/hunting)

Run the update

Suricata service restart

4. Configuring Suricata as an IPS

①Return to nfqueue mode

Create the following custom signature to scan for SSH traffic on non-SSH ports, and include it in the file /var/lib/suricata/rules/local.rules (assuming the SSH port is 22)

Edit the SURICATA configuration file

Verify SURICATA settings

Suricata restart

Redirect incoming network traffic to Suricata's NFQUEUE
Since Firewalld is installed and enabled, add the rules required by Suricata to Firewalld (assuming the SSH port is 22)

Similarly, edit /etc/ufw/before6.rules

Verify that SURICATA is dropping traffic correctly
Change the default action for signatures from "alert" or "log" to "active dropping traffic"
Open the /var/lib/suricata/rules/suricata.rules file and comment out any entries matching "sid:2100498"

Create a new rule with the ID 2100498 in /var/lib/suricata/rules/local.rules

Reload the signature

Test this rule using curl

Examining the eve.log file using jq

"action" is set to "blocked"

Integration of the ELK Stack and Suricata

Install and configure the Elastic Stack to visualize and search SURICATA logs more efficiently
This section will primarily be performed on the second Debian 13.x server (IP 192.168.11.85).
For specific instructions, please refer to the page below.

Starting Elasticsearch

Start and enable the service

systemctl daemon-reload
systemctl enable --now elasticsearch
systemctl start elasticsearch

Verify Operation
Use the curl command to verify that Elasticsearch is running.
You will be prompted for the Elasticsearch password. 

Kibana Install

Install and configure Kibana to visualize SURICATA logs
This section will primarily be performed on the second Debian 13.x server (IP 192.168.11.85).
For specific instructions on how to access the Kibana 9 dashboard after installing Kibana, please refer to the page below.

Install Filebeat on the SURICATA server

1.Install

2. Creating an Elasticsearch CA Certificate
Download the Elasticsearch CA certificate and save it to a directory of your choice (in this example, we’ll save it as /etc/filebeat/elastic-ca.crt).
*Make sure to open port 9200 on the second server (the server running Debian 13.x with Elasticsearch installed).

3. Configure Filebeat to connect to Elasticsearch and Kibana

4. Configuration File Test

5. Enable Filebeats' built-in Suricata module

The command above will rename /etc/filebeat/modules.d/suricata.yml.disabled to /etc/filebeat/modules.d/suricata.yml, but since the contents remain unchanged, edit it as follows:

6. Set up the initial environment
Pipeline for the Suricata service
Load the SIEM dashboard into Elasticsearch

7. Start the Filebeat service

For further information, please refer to the page below