Ubuntu Server25.10 : Suricata + Elastic Stack

Prerequisites

This time, we will install Suricata IDS and ElasticStack on the following server.
・First Server　Suricata IDS & Filebeat　: Ubuntu Server25.10 IP Address(192.168.11.83)
・Second server　ElasticStack & kibana　: Ubuntu Server24.04 IP Addtress(192.168.11.85)
Run as a sudo user other than root

 First Server　Suricata

SURICATA IDS/IPS is an open source IDS that monitors communications on the network and detects suspicious traffic.
The basic mechanism is signature-based, so it can detect predefined unauthorized communications. Suricata is also characterized by its ability to provide protection as well as detection.。

1.Suricata Install

Version Check

Enable the suricata.service

Since the Suricata service must be configured first, stop the service.

2.Configure Suricata

①Determine interface and IP address where Suricata will inspect network packets

Edit the /etc/suricata/suricata.yaml file

SURICATA supports live rule reloading, allowing you to add, remove, or edit rules without restarting the running SURICATA process.
To enable the live reload option, scroll to the bottom of the configuration file and add the following line:

This setting allows you to send a SIGUSR2 system signal to the running process, causing SURICATA to reload the modified rules into memory.
The following command notifies the SURICATA process to reload the rule set without restarting the process:

➁Add a rule set
Suricata includes a tool called suricata-update that can retrieve rule sets from external providers.
Executing the following command will download the latest rule set for the SURICATA server:

suricata-update has obtained the free Emerging Threats ET Open Rules and saved them to the /etc/suricata/rules/suricata.rules file in Suricata.
Additionally, it shows the number of processed rules, with 63,373 added in this example, of which 47,545 became active.

➂Add Rule Set Provider
Display the list of default providers

For example, when including the tgreen/hunting rule set

Perform the update

3.Testing Suricata Configuration

①Changing the Default Rule Path

➁Run the verification tool

Restart the Suricata service

Check the log file

4.Testing Suricata Rules

①Test ET Open rule number 2100498 using the following command:

②Check the log file using the specified rule number.

 ③Checking events in /var/log/suricata/eve.log

Install jq

Search for signature 2100498 to filter EVE log events
Display the alert object with a signature_id key matching the value 2100498

④Creating and Applying Custom Rules
Create the following custom signature to scan SSH traffic to non-SSH ports, and include it in the file /etc/suricata/rules/local.rules (IPv4 only in this case).

Editing suricata.yaml

Verify SURICATA Configuration

Edit the custom signature from earlier and convert it to use a drop action.

⑤Reset SURICATA and restart it in IPS mode.

SURICATA operates in IDS mode by default and does not actively block network traffic.
To switch to IPS mode, you need to change SURICATA's default settings.

Use the systemctl edit command to create a new systemd override file:

Add the following text in red at the beginning

Reload the configuration and restart Suricata.

With this change, you are now ready to send traffic to Suricata using the UFW firewall.

⑥Configuring UFW to send traffic to Suricata
To add the rules required for Suricata to UFW, you must directly edit the firewall files /etc/ufw/before.rules and /etc/ufw/before6.rules.

Similarly, modify /etc/ufw/before6.rules.

Restart UFW

Verify that SURICATA is correctly dropping traffic.
Switch the signature's default action from alert or log to active dropping traffic.
Open the /etc/suricata/rules/suricata.rules file and comment out any entries matching sid:2100498.

Create a new entry as sid:2100498 in /etc/suricata/rules/local.rules

Suricata restart

Test this rule using curl

Using jq to check eve.log for "action": "blocked"

Elastic stack 9.x　Install

Install and configure the Elastic Stack to visualize and search SURICATA logs
This section is primarily performed on a second Ubuntu 24.04 server.

①Install the Elastic Stack 9.x repository signing key

➁Install the Elastic Stack 9.x repository

update

➂Installing Elasticsearch 9.x on Ubuntu 24.04

During installation, security features are enabled by default;

Authentication and authorization are enabled.
TLS is enabled and configured at the transport layer and HTTP layer.
An Elastic superuser account (elastic) and its password will be created.

④Configuring Elasticsearch 9.x on Ubuntu
Since this is a basic single-node cluster, we will use the default settings.

Checking the Elasticsearch configuration file /etc/elasticsearch/elasticsearch.yml reveals that security settings are enabled.

⑤Starting Elasticsearch

Start Elasticsearch and configure it to run at system startup.

Check the status

You can also use the curl command to check the status of Elasticsearch. Replace the IP address as appropriate.

When prompted, enter the Elasticsearch password generated during Elasticsearch installation.
The output will appear as follows:

Also, ensure that both the HTTP port and the transport port are open;

⑥Resetting Elasticsearch Passwords
The automatically generated Elastic user password is too complex, so reset it using the /usr/share/elasticsearch/bin/elasticsearch-reset-password command.
To reset your password, execute the command.

⑦Elasticsearch Logs
Elasticsearch writes logs to the /var/log/elasticsearch path. The log file you need to check when there is an issue with the Elasticsearch instance is /var/log/elasticsearch/CLUSTER_NAME.log.

CLUSTER_NAME is the value of the cluster.name option in the elasticsearch.yaml file.
If this value is not changed, the default is elasticsearch, and the log file will be located at /var/log/elasticsearch/elasticsearch.log.

Log

Kibana 9.x Install

This section is primarily performed on a second Ubuntu 24.04 server.

①Install

➁Configuring Kibana 9
Kibana is configured by default to run on localhost:5601. To allow external access, edit the configuration file and replace the value of server.host with the interface IP.

Rewrite as follows:

➂Generating a Kibana-Elasticsearch Enrollment Token
To configure a Kibana instance to communicate with an existing Elasticsearch cluster with security enabled, an enrollment token is required. An enrollment token for Kibana can be generated using the following command:

④Generating Kibana Encryption Keys
Kibana uses encryption keys in several areas, from encrypting data in Kibana-related indices to storing session information. The required keys are as follows:

• xpack.encryptedSavedObjects.encryptionKey:Used to encrypt saved objects such as dashboards and visualizations.
• xpack.reporting.encryptionKey: Used for encrypting saved reports
• xpack.security.encryptionKey: Used for encrypting session information

These are generated using the following command:

The output will be as follows:

Insert the above into Kibana's configuration file kibana.yml.

⑤Running Kibana
Launch Kibana 9 and configure it to run at system startup.

status

The following appears toward the end of the output:

Copy the provided Kibana URL (including the code) and use it in your browser to access Kibana and complete the setup.

Similarly, Kibana logs are available in /var/log/kibana/kibana.log and /var/log/syslog.

⑥Accessing the Kibana 9 Dashboard

access http://192.168.11.85:5601/?code=983617
(Copy each person's appropriate address)

If UFW is running, open the Kibana port.

When you access Kibana 9, the welcome page prompts you to configure Elastic.
First, enter the generated registration token.
Copy the Kibana token generated using the command /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana and paste it into the box.

access http://192.168.11.85:5601/?code=983617

Paste the token, and Kibana will automatically connect to Elasticsearch.
Click Configure Elastic. The settings will be saved, and Elasticsearch will be configured and restarted.

Proceed to the login page. Log in using the generated Elastic user credentials.

On the welcome page, click "Explore on my own" to proceed to the Kibana 9.x dashboard.

Installing Filebeat 9

To collect and monitor logs from Ubuntu 25.10 using the ELK Stack, you need to install Filebeat.
This task will be performed on the first server, Ubuntu 25.10, with the IP address 192.168.11.83.

①Install the Elastic Stack 9.x repository signing key

➁Install the Elastic Stack 9.x repository

update

➂Installing filebeat 9.x on Ubuntu 25.10

④Filebeat Logging Configuration

The default Filebeat configuration file is located at /etc/filebeat/filebeat.yml.
To configure Filebeat to write logs to its own log file, enter the following setting in the configuration file:

⑤Connect Filebeat to the data processing system
Configure Filebeat to connect to the data processing system. In this case, it is Elasticsearch.
To send logs directly to Elasticsearch, edit the Filebeat configuration file and update the output configuration section.

Connecting to Elasticsearch 9 requires SSL and authentication.
Verify that you can connect to Elasticsearch port 9200/tcp (Port 9200 is open on the second server running Ubuntu 24.04).

⑥Creating an Elasticsearch CA Certificate
Download the Elasticsearch CA certificate and save it to any directory (in this case, save it as /etc/filebeat/elastic-ca.crt).

Retrieve the credentials Filebeat uses for Elasticsearch authentication. In this case, use the credentials for the default superuser, the Elastic user.

⑤Configuration File Test

⑦Enable the built-in Suricata module in Filebeats

The above command will change /etc/filebeat/modules.d/suricata.yml.disabled to /etc/filebeat/modules.d/suricata.yml, but the contents remain unchanged. Therefore, edit it as follows:
Modify modules.d/suricata.yml as follows:

⑧Set up the initial environment
Load SIEM dashboards and pipelines into Elasticsearch
Execute the filebeat setup command

⑨Start the Filebeat service

⑩Check in Kibana

I will log back into Kibana.
accsess http://192.168.11.85:5601

Enter "Suricata Events Overview" in the top search field, then click [Filebeat Suricata]Events Overview.

All Suricata events from the past 15 minutes are displayed.

To display alerts for malicious traffic, click the "Alerts" text next to the Suricata logo.

Create a new user account so that you do not need to use the elastic superuser account.
Click the three horizontal lines icon in the upper left corner, then select [Stack Management] under [Management].

Select "Security" and "Users"

Click the "Create user" button in the upper right corner.

Enter the new user information, assign the kibana_admin, kibana_system, monitoring_user, and editor roles under Privileges, and finally click [Create user].

Log out of the current profile and verify that you can log in with the newly created user account.