Installation
- sudo apt update
- sudo apt -y install suricata
- suricata -V
This is Suricata version 6.0.1 RELEASE
Update Rules
Suricata minimale Konfiguration
- vim /etc/suricata/suricata.yml
%YAML 1.1
---
vars:
address-groups:
HOME_NET: "[172.16.1xx.0/24,10.0.1xx.0/24]"
EXTERNAL_NET: "!$HOME_NET"
default-log-dir: /var/log/suricata/
stats:
enabled: yes
interval: 8
outputs:
- fast:
enabled: yes
filename: fast.log
append: yes
- alert-debug:
enabled: yes
filename: alert-debug.log
append: yes
- stats:
enabled: yes
filename: stats.log
append: yes # append to file (yes) or overwrite it (no)
totals: yes # stats for all threads merged together
threads: no # per thread stats
logging:
default-log-level: notice
outputs:
- console:
enabled: yes
- file:
enabled: yes
level: info
filename: suricata.log
# type: json
af-packet:
- interface: enp0s3
threads: auto
cluster-id: 99
cluster-type: cluster_flow
defrag: yes
- interface: enp0s8
threads: auto
cluster-id: 99
cluster-type: cluster_flow
defrag: yes
- interface: enp0s9
threads: auto
cluster-id: 99
cluster-type: cluster_flow
defrag: yes
pid-file: /var/run/suricata.pid
coredump:
max-dump: unlimited
host-mode: auto
unix-command:
enabled: yes
filename: /var/run/suricata-command.socket
engine-analysis:
rules-fast-pattern: yes
rules: yes
defrag:
memcap: 32mb
hash-size: 65536
trackers: 65535 # number of defragmented flows to follow
max-frags: 65535 # number of fragments to keep (higher than trackers)
prealloc: yes
timeout: 60
default-rule-path: /etc/suricata/rules
rule-files:
- local.rules
classification-file: /etc/suricata/classification.config
reference-config-file: /etc/suricata/reference.config