Suricata Installation

Installation

• sudo apt update
• sudo apt -y install suricata
• suricata -V

This is Suricata version 6.0.1 RELEASE

Install Rules

• wget http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz
• tar zxvf emerging.rules.tar.gz
• cd rules
• cat *.rules > /etc/suricata/rules/suricata.rules

Suricata minimale Konfiguration

• vim /etc/suricata/suricata.yml

%YAML 1.1
---
vars:
  address-groups:
    HOME_NET: "[172.16.1xx.0/24,10.0.1xx.0/24]"
    EXTERNAL_NET: "!$HOME_NET"
default-log-dir: /var/log/suricata/
stats:
  enabled: yes
  interval: 8
outputs:
  - fast:
      enabled: yes
      filename: fast.log
      append: yes
  - alert-debug:
      enabled: yes
      filename: alert-debug.log
      append: yes
  - stats:
      enabled: yes
      filename: stats.log
      append: yes       # append to file (yes) or overwrite it (no)
      totals: yes       # stats for all threads merged together
      threads: no       # per thread stats
logging:
  default-log-level: notice
  outputs:
  - console:
      enabled: yes
  - file:
      enabled: yes
      level: info
      filename: suricata.log
      # type: json
af-packet:
  - interface: enp0s3
    threads: auto
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
  - interface: enp0s8
    threads: auto
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
  - interface: enp0s9
    threads: auto
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
pid-file: /var/run/suricata.pid
coredump:
  max-dump: unlimited
host-mode: auto
unix-command:
  enabled: yes
  filename: /var/run/suricata-command.socket
engine-analysis:
  rules-fast-pattern: yes
  rules: yes
defrag:
  memcap: 32mb
  hash-size: 65536
  trackers: 65535 # number of defragmented flows to follow
  max-frags: 65535 # number of fragments to keep (higher than trackers)
  prealloc: yes
  timeout: 60
default-rule-path: /etc/suricata/rules
rule-files:
  - local.rules
classification-file: /etc/suricata/classification.config
reference-config-file: /etc/suricata/reference.config