Aktuelle Version vom 24. April 2025, 15:40 Uhr

Installation

sudo apt update
sudo apt -y install suricata
systemctl stop suricata
suricata -V

This is Suricata version 6.0.1 RELEASE

@@ Zeile 2: / Zeile 2: @@
 *sudo apt update
 *sudo apt -y install suricata
+*systemctl stop suricata
 *suricata -V
   This is Suricata version 6.0.1 RELEASE
-=Install Rules=
+<!--
-*wget http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz
+=Update Rules=
-*tar zxvf emerging.rules.tar.gz
-*cd rules
-*cat *.rules > /etc/suricata/rules/suricata.rules
-=Suricata minimale Konfiguration=
-* '''vim /etc/suricata/suricata.yml'''
+* suricata-update
+-->
- %YAML 1.1
- ---
- vars:
-   address-groups:
-     HOME_NET: "[172.16.1''xx''.0/24,10.0.1''xx''.0/24]"
-     EXTERNAL_NET: "!$HOME_NET"
- default-log-dir: /var/log/suricata/
- stats:
-   enabled: yes
-   interval: 8
- outputs:
-   - fast:
-       enabled: yes
-       filename: fast.log
-       append: yes
-   - alert-debug:
-       enabled: yes
-       filename: alert-debug.log
-       append: yes
-   - stats:
-       enabled: yes
-       filename: stats.log
-       append: yes       # append to file (yes) or overwrite it (no)
-       totals: yes       # stats for all threads merged together
-       threads: no       # per thread stats
- logging:
-   default-log-level: notice
-   outputs:
-   - console:
-       enabled: yes
-   - file:
-       enabled: yes
-       level: info
-       filename: suricata.log
-       # type: json
- af-packet:
-   - interface: enp0s3
-     threads: auto
-     cluster-id: 99
-     cluster-type: cluster_flow
-     defrag: yes
-   - interface: enp0s8
-     threads: auto
-     cluster-id: 99
-     cluster-type: cluster_flow
-     defrag: yes
-   - interface: enp0s9
-     threads: auto
-     cluster-id: 99
-     cluster-type: cluster_flow
-     defrag: yes
- pid-file: /var/run/suricata.pid
- coredump:
-   max-dump: unlimited
- host-mode: auto
- unix-command:
-   enabled: yes
-   filename: /var/run/suricata-command.socket
- engine-analysis:
-   rules-fast-pattern: yes
-   rules: yes
- defrag:
-   memcap: 32mb
-   hash-size: 65536
-   trackers: 65535 # number of defragmented flows to follow
-   max-frags: 65535 # number of fragments to keep (higher than trackers)
-   prealloc: yes
-   timeout: 60
- default-rule-path: /etc/suricata/rules
- rule-files:
-   - local.rules
- classification-file: /etc/suricata/classification.config
- reference-config-file: /etc/suricata/reference.config

Suricata Installation: Unterschied zwischen den Versionen

Aktuelle Version vom 24. April 2025, 15:40 Uhr

Installation

Navigationsmenü

Suche