Suricata: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
 
(12 dazwischenliegende Versionen von 2 Benutzern werden nicht angezeigt)
Zeile 1: Zeile 1:
*[[Was ist Suricata]]
+
*[[Suricata Grundlagen]]
 +
 
 
*[[Suricata Installation]]
 
*[[Suricata Installation]]
 +
*[[Suricata Schaubild]]
 +
*[[Suricata IDS]]
 +
*[[Suricata IPS]]
 +
*[[Suricata Links]]
 +
*[[Suricata Rules]]
 +
*[[Suricata Lua]]
 +
*
  
=Schaubild=
+
= Warum ist die Software nach Erdmännchen bennant? =
;suricata
 
*WANDEV=enp0s3
 
*LANDEV=enp0s8
 
{{#drawio:ids}}
 
=IDS=
 
==Local Rules==
 
*cat  /etc/suricata/rules/local.rules
 
alert icmp any any -> any any (msg:"ICMP Test"; sid:1000000002;)
 
alert tcp any any -> any any (flags: S; msg: "SYN packet"; sid:100000003;)
 
 
 
*https://suricata.readthedocs.io/en/suricata-6.0.0/rules/
 
 
 
==Start suricata==
 
*suricata -i $LANDEV
 
 
 
==check==
 
*tail -f /var/log/suricata/fast.log
 
  
=IPS=
+
ChatGPT sagt folgendes:
*Wir können mit iptables Pakete abfangen und einer QUEUE übergeben
 
*Diese QUEUE wird von suricata gelesen und ihrem REGELWERK übergeben.
 
*Wenn das Paket mit einer Regel übereinstimmt, wird eine Aktion ausgelöst.
 
*Alert führt zu einer Meldung
 
*Bei Drop wird das Paket verworfen.
 
{{#drawio:ips}}
 
==Local Rules==
 
*cat  /etc/suricata/rules/local.rules
 
drop icmp any any -> 10.0.10.11 any (msg:"DROP Test"; sid:1000000001;)
 
alert icmp any any -> any any (msg:"ICMP Alert Test"; sid:1000000002;)
 
  
==Start suricata==
+
''In a realm where data flows like streams,''
*suricata -q0
+
''Where networks hum and echo dreams,''
==Send all Forward Packets to suricata==
+
''A guardian stands with eyes so keen,''
*iptables -I FORWARD -i $WANDEV -o $LANDEV -j NFQUEUE
+
''Suricata, the vigilant machine.''
 +
 +
''Named after meerkats, watchful and wise,''
 +
''It scans the traffic beneath the skies,''
 +
''With furrowed brows and lines of code,''
 +
''Through packets and bytes, its insights bestowed.''
 +
 +
''Intrusions it seeks with diligence rare,''
 +
''A meerkat's spirit it aims to bear,''
 +
''Alert and aware, it never tires,''
 +
''Through digital valleys and electronic fires.''
 +
 +
''Just as meerkats stand guard in the sun,''
 +
''Suricata watches, its work never done,''
 +
''In cyber fields, a protector so true,''
 +
''It shields and defends, no matter the view.''
 +
 +
''With each connection, a sentinel's gaze,''
 +
''It parses the data in myriad ways,''
 +
''An echo of nature, a name well chosen,''
 +
''Suricata stands watch, its purpose unbroken.''
 +
 +
''So remember the meerkat, small and strong,''
 +
''As Suricata defends against all wrong,''
 +
''In the digital wilds where dangers may creep,''
 +
''A guardian stands vigil, even in sleep.''
  
 
=Links=
 
=Links=
*https://www.pro-linux.de/artikel/2/1751/suricata-einbruchserkennung-mit-dem-erdm%C3%A4nnchen.html
+
* https://www.pro-linux.de/artikel/2/1751/suricata-einbruchserkennung-mit-dem-erdm%C3%A4nnchen.html
*https://www.howtoforge.com/tutorial/suricata-with-elk-and-web-front-ends-on-ubuntu-bionic-beaver-1804-lts/
+
* https://www.howtoforge.com/tutorial/suricata-with-elk-and-web-front-ends-on-ubuntu-bionic-beaver-1804-lts/
*https://suricata.readthedocs.io/en/suricata-4.1.0/index.html
+
* https://suricata.readthedocs.io/en/suricata-4.1.0/index.html
*https://suricata.readthedocs.io/en/suricata-5.0.3/setting-up-ipsinline-for-linux.html?highlight=inline
+
* https://suricata.readthedocs.io/en/suricata-5.0.3/setting-up-ipsinline-for-linux.html?highlight=inline
 +
* https://www.howtoforge.de/anleitung/so-installierst-und-konfigurierst-du-suricata-ids-zusammen-mit-elastic-stack-auf-rocky-linux-8
 +
* https://www.digitalocean.com/community/tutorials/how-to-install-suricata-on-debian-11
 +
* https://rules.emergingthreats.net/
 +
[[Kategorie:Suricata]]
 +
[[Kategorie:Cybersecurity]]
 +
[[Kategorie:Firewall]]

Aktuelle Version vom 22. Mai 2025, 08:40 Uhr

Warum ist die Software nach Erdmännchen bennant?

ChatGPT sagt folgendes:

In a realm where data flows like streams,
Where networks hum and echo dreams,
A guardian stands with eyes so keen,
Suricata, the vigilant machine.

Named after meerkats, watchful and wise,
It scans the traffic beneath the skies,
With furrowed brows and lines of code,
Through packets and bytes, its insights bestowed.

Intrusions it seeks with diligence rare,
A meerkat's spirit it aims to bear,
Alert and aware, it never tires,
Through digital valleys and electronic fires.

Just as meerkats stand guard in the sun,
Suricata watches, its work never done,
In cyber fields, a protector so true,
It shields and defends, no matter the view.

With each connection, a sentinel's gaze,
It parses the data in myriad ways,
An echo of nature, a name well chosen,
Suricata stands watch, its purpose unbroken.

So remember the meerkat, small and strong,
As Suricata defends against all wrong,
In the digital wilds where dangers may creep,
A guardian stands vigil, even in sleep.

Links