Advanced Suricata rule writing and performance
With datasets, flowbits, Lua scripts and rule profiling you write rules that are both accurate and fast, and put the ruleset through quality checks.
Level 401 · 14 lessons · 12 practice labs
Lessons
Advanced keywords
- Sticky buffers and transforms: http.uri, dns.query, to_lowercase
- flowbits and xbits: multi-step detection
- Matching thousands of indicators in one rule with datasets
- byte_test, byte_jump and matching in binary protocols
- Short task: write a rule chain that catches a client logging in and then downloading a file
Lua and custom logic
- Lua-scripted rules: extending match logic
- Producing custom logs with Lua output scripts
- Safety and performance limits in Lua rules
- Short task: write a Lua rule scoring the randomness of a domain name
Performance and quality
- Rule profiling: finding the most expensive rules
- Improving fast_pattern and prefilter choice
- Rule QA: syntax, overlaps and test PCAPs
- Versioning and rolling back a ruleset
- Capstone: speed up a slowing sensor’s ruleset while keeping its accuracy
Practice labs
- Match a domain with a sticky buffer: Write and test a rule catching one domain using the dns.query buffer.
- Close the case trick with a transform: Add the to_lowercase transform to write a rule that also fires on mixed-case requests.
- Match a binary protocol with byte_test: Write a rule reading a custom lab protocol's length field with byte_test and byte_jump to catch oversized messages.
- Match an indicator list with a dataset: Load a list of a thousand domains as a dataset and show matches with a single rule.
- The client that logs in and then downloads: Write a two-rule chain with flowbits catching a client that logs in and then downloads a file.
- Host-level correlation with xbits: Write a rule pair tying two steps in different flows to the same host with xbits and test the expiry.
- Run a first Lua rule: Attach a ready-made Lua script to a rule and show with a log that the match function is called.
- A domain randomness score: Write a Lua rule computing the entropy of the DNS query name and firing above a threshold.
- A custom log with a Lua output script: Write a Lua output script logging server name and fingerprint per TLS session on one line and measure its performance cost.
- Find the most expensive rules: Enable rule profiling and list the five rules consuming the most time.
- Improve the fast_pattern choice: Make the more distinctive content the fast_pattern in a slow rule and show the difference in the profile.
- Speed up a slowing sensor's rule set: Rewrite three expensive rules in the Yakamoz Telekom lab sensor's rule set and prove with test PCAPs that accuracy is kept.
About this course
With datasets, flowbits, Lua scripts and rule profiling you write rules that are both accurate and fast, and put the ruleset through quality checks.
What you will learn
- Advanced keywords
- Lua and custom logic
- Performance and quality
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.