Suricata documentation

1. Environment Setup
 Install Suricata on a virtual machine. -Ensure the system has all necessary
dependencies installed (e.g., libpcap, libnet, etc.).
o Sudo apt update
o Sudo apt install suricata:
 Necessary dependencies will be installed automatically:

2. Initial Configuration
 Configure the Suricata YAML file (/etc/suricata/suricata.yaml).
o sudo nano /etc/suricata/suricata.yaml
 Set up network interfaces for live traffic capture.
o Locate “af-packet” section and replace “interface” with correct one
(in this case “eth1”)
o Change setting like below:

 Configure logging to output to both JSON and EVE (for later analysis).
o Locate “ouput” section and configure accordingly for basic setup:
o Save and close when done
 Sudo suricata-update
o Restart Suricata to apply changes:
 Sudo systemctl restart suricata
 Regular

3. Basic Testing
 Start Suricata in live mode and ensure it is capturing traffic.
 Generate some network traffic and verify it is being logged by Suricata.
 Use tools like curl, ping, and nmap to generate various types of traffic.

 Install evebox for getting dashboard view of json file:

o sudo apt-get install wget gnupg apt-transport-https
wget -qO - https://evebox.org/files/GPG-KEY-evebox | sudo apt-key add -
echo "deb http://evebox.org/files/debian unstable main" | sudo tee
/etc/apt/sources.list.d/evebox-unstable.list
sudo apt-get update
sudo apt-get install evebox
 run evebox, this will open a webbrowser with data:
o evebox oneshot /var/log/suricata/eve.json:
 Analyze/detect the generated traffic:
o Curl:

o Ping:
In evebox, this event is not visible (extra configuration might help).
However in the eve.json log, we can track the ping request

o Nmap:
 o Ssh:

4. Creating Custom Rules

 Create at least 5 custom Suricata rules that detect specific types of network behavior
(e.g., detecting SSH login attempts, HTTP requests to a specific URI, suspicious DNS
queries).
 Test these rules by generating the appropriate network traffic and ensure they trigger
correctly.

5. Deliverables
 A screenshot of the Suricata configuration file.
 Zip file with Logs showing Suricata successfully capturing and logging traffic.
 A brief report (3 pages) on setup, initial findings, issues encountered.