Network-based detection with Suricata
You run Suricata as a network sensor, manage rulesets, write your own signatures, examine the EVE JSON output and block attacks in inline mode.
Level 301 · 16 lessons · 15 practice labs
Lessons
The sensor
- Sensor placement: mirror port, tap, inline
- Installing and configuring Suricata: HOME_NET, interfaces
- EVE JSON output: alert, flow, http, dns, tls
- Replaying recorded traffic to the sensor
- Short task: summarise all alerts in a pcap by source
Writing rules
- Anatomy of a rule: action, header, options
- Content matching and sticky buffers
- Flow, state and threshold options
- Protocol keywords: http, dns, tls.sni
- Short task: write a signature that catches C2 beaconing
Operations
- Ruleset management: suricata-update, sources, disabling
- Performance: packet drops and statistics
- Inline IPS mode: drop and reject
- File extraction and hash logging
- Short task: block an attack in IPS mode without breaking legitimate traffic
Capstone
- Capstone: deploy a sensor on the company network, write signatures and catch an attack
Practice labs
- Summarise the alerts in a pcap by source: Run the capture through Suricata and count alerts by signature and source address from the EVE JSON.
- Tie an alert to the http and dns records of the same flow: Link the alert to the protocol records through flow_id and find the name of the downloaded file.
- Find the signatures silenced by a HOME_NET mistake: Show which alerts the wrong network definition suppresses, fix it and count the new alerts on the same capture.
- Write a signature that catches a specific User-Agent: Write a rule using the http.user_agent buffer and show it catches only the relevant requests in the capture.
- Write a signature for DNS queries to a suspicious domain: Catch the domain pattern with dns.query, cover letter-case differences and test it.
- Find the request this signature misses and fix it: Find that the content match looks at the wrong buffer, fix the sticky buffer and catch the missed request.
- Write a threshold signature for a regular C2 call-out: Write a rule that uses threshold to reduce small periodic requests from one source to a single alert.
- Catch encrypted traffic by TLS SNI without the payload: Write a rule using tls.sni and certificate fields and catch the connection with a fake certificate.
- Disable a noisy signature in the ruleset: Add the signature to disable.conf for suricata-update, refresh the rules and show it is no longer loaded.
- Diagnose a sensor dropping packets from its statistics: Find the drop rate in stats.log, identify the cause, change the setting and measure again.
- Extract passing files and record their hashes: Turn on file extraction, take the download’s hash from the files record and compare it with the threat list.
- Drop the attack in IPS mode and keep legitimate traffic: Set a single signature to drop and test both ways that the attack is cut while normal requests pass.
- Find the flow that sent the most data in EVE: Sort flow records by byte count and note the endpoints and duration of the largest flow.
- Suppress a noisy signature for a single source: Add a suppress line in threshold.config covering only the vulnerability scanner that keeps triggering a signature, and show other sources still alert.
- Join flow, file and alert records to find the file that left: Link EVE records by flow_id to recover the name, hash and size of the file sent out in the session that raised the alert.
About this course
You run Suricata as a network sensor, manage rulesets, write your own signatures, examine the EVE JSON output and block attacks in inline mode.
What you will learn
- The sensor
- Writing rules
- Operations
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.