Suricata IDS

Local Rules

• cat /etc/suricata/rules/local.rules

alert icmp any any -> any any (msg:"ICMP Test"; sid:1000000002;)
alert tcp any any -> any any (flags: S; msg: "SYN packet"; sid:100000003;)

• https://suricata.readthedocs.io/en/suricata-6.0.0/rules/

Start suricata

• suricata -i $DMZDEV

check

• tail -f /var/log/suricata/fast.log