[Day 9] 5. Suricata

Suricata is an open-source, high-performance Intrusion Detection and Prevention System (IDS/IPS) that analyzes network traffic for malicious activity. It’s fast, scalable, and supports real-time traffic analysis, alerting, and logging, making it a popular alternative to Snort for network security monitoring. It can be called as a lightweight and easy configurable version of Snort.

Suricata Installation and Configuration

1. Install Suricata:

   bashCopy
   sudo apt-get install suricata
   

2. Check the status: Run the following command to see if Suricata is running. Initially, it should show as "failed":

   bashCopy
   sudo systemctl status suricata
   

3. Edit Suricata YAML configuration: Open the Suricata configuration file:

   bashCopy
   sudo vim /etc/suricata/suricata.yaml
   

   • Set the correct network interface: Look for the

     Copy

     af-packet:

     section and change it to your working interface (e.g.,
     Copy

     ens33

     ).

   • Add rule files: Search for the

     Copy

     rule-files

     section and add the following lines:

     plaintextCopy
     rule-files:
       - suricata.rules
       - local.rules
     

4. Create custom rules: Create a

   Copy

   local.rules

   file:

   bashCopy
   sudo nano /etc/suricata/rules/local.rules
   

   Add the following rule to

   Copy

   local.rules

   :

   textCopy
   alert icmp any any -> any any (msg: "Kuch Bhi"; sid:1000001; rev:1;)
   

5. Restart and Check the Suricata status again:

   bashCopy
   sudo systemctl restart suricata
   sudo systemctl status suricata
   

6. Test Suricata:

   • Ping the machine from another device to generate traffic.
   • Monitor Suricata logs in real-time using:

   bashCopy
   sudo tail -f /var/log/suricata/fast.log
   

This setup makes Suricata capture and alert on ICMP traffic, similar to Snort, but it's more lightweight and easier to configure. You can further refine Suricata's functionality by adding more specific rules or changing its configurations.