Network detection and prevention with Suricata
You install Suricata, write rules, review EVE JSON logs with jq, cut false alarms and stop suspicious traffic in inline mode.
Level 301 · 20 lessons · 18 practice labs
Lessons
Getting started
- What Suricata is: IDS, IPS and network security monitoring: You learn the difference between Suricata watching traffic and raising alerts versus blocking it, and how it differs from Snort.
- Installing Suricata and choosing the interface to listen on: You will install Suricata, start it on the right network interface and confirm from its logs that it is running.
- suricata.yaml: HOME_NET and output settings: You will define your protected network as HOME_NET and set in suricata.yaml which logs are written where.
- Safe practice by running a saved pcap through Suricata: Without touching a live network, you will process a saved traffic file with Suricata and review the alerts it produces.
- Short task: run a PCAP through Suricata and count the event types in eve.json
Rules
- Managing rule sets with suricata-update: You will download and update ready-made rule sets with suricata-update and disable the rules you do not need.
- Suricata rule anatomy: action, header and options: You will break a Suricata rule into parts and read which traffic each part selects and when it raises an alert.
- Protocol-specific keywords: http, dns, tls: You will write more precise rules that look at fields such as the HTTP URL, the DNS query or the TLS server name.
- Writing local rules and testing them with a pcap: You will write a rule specific to your organisation and test it against saved traffic to confirm it raises the expected alert.
- Reducing noise with thresholds and suppression: You will cut hundreds of alerts for the same event with threshold settings and suppress known safe sources.
- Short task: write two rules that catch one malicious domain in DNS and in TLS
Logs and analysis
- Understanding EVE JSON logs: alerts, flows and protocol events: You will recognise the event types in Suricata’s eve.json and link an alert to its related flow and protocol record.
- Filtering and summarising alerts from eve.json with jq: With jq you will pull out the most frequent alerts, the busiest source addresses and how alerts spread over time.
- Recording files crossing the network: fileinfo and file extraction: You will log the name, type and fingerprint of files sent across the network and keep a copy for review when needed.
- Spotting unknown clients with TLS fingerprints (JA3, JA4): Without looking inside encrypted traffic, you will single out unusual programs from the client’s TLS fingerprint.
- Short task: write a jq command summarising alerts by signature and source IP
Prevention and operations
- Blocking traffic in inline (IPS) mode with NFQUEUE: You will place Suricata in the traffic path, drop connections that match chosen rules and confirm legitimate traffic still passes.
- Packet loss and performance: reading the statistics: You will see from stats.log whether Suricata is missing packets and fix it with thread and memory settings.
- Shipping alerts to a central log system: You will send eve.json records to a central log system and review them on the same screen as other server logs.
- Capstone: a rule set that detects unauthorised data leaving the network: You write rules that catch file uploads to an unapproved server, weed out false alarms and report the result with evidence.
Practice labs
- Pass a PCAP through Suricata: Process a prepared capture with Suricata and count the event types in eve.json.
- HOME_NET and outputs in suricata.yaml: Set HOME_NET for the lab network, enable only alert and DNS events in eve.json output and verify the result.
- Set up listening on a live interface: Run Suricata as a service on the correct lab interface and prove that test traffic produces events.
- Split a rule into action, header and options: Explain the parts of three Suricata rules and write in one sentence what each catches.
- Write a local rule and test it with a pcap: Write a local rule catching a specific user agent and show it fires on a prepared capture.
- Manage rule sources with suricata-update: Enable a rule source, disable two signatures and show the change reflected in the loaded rule count.
- Match with http keywords: Write a rule catching requests to a specific path using the http.uri buffer.
- Catch the same domain in DNS and TLS: Write and test two rules catching one domain in both the DNS query and the TLS server name.
- Narrow a rule that false-alarms: Move a broad content rule that fires on every response to the right buffer and direction to remove the false alarms.
- Filter the alerts in eve.json: Select only alert events with jq and list the signature names.
- A summary by signature and source IP: Write a one-line jq command counting alerts by signature and source address.
- Tie an alert to its flow and protocol events: Use an alert's flow_id to join the flow, HTTP and file events of the same session in one output.
- List the fileinfo events: Extract the name, type and size of files crossing the network from fileinfo events.
- Store a file crossing the network to disk: Enable file extraction, store the download in a prepared capture to disk and compare its hash with eve.json.
- Find the unknown TLS client by fingerprint: Count JA3 and JA4 values and report the fingerprint seen on only one host and the servers it connected to.
- Read the packet drop statistics: Take the captured, dropped and decoded packet counts from stats.log and calculate the drop rate.
- Write threshold and suppress rules: Suppress a noisy signature for one source, put a threshold on another and compare alert counts before and after.
- Stop unauthorised data egress in inline mode: Run inline with NFQUEUE on the lab network, write a rule dropping an unauthorised upload pattern and prove it is blocked.
About this course
You install Suricata, write rules, review EVE JSON logs with jq, cut false alarms and stop suspicious traffic in inline mode.
What you will learn
- Getting started
- Rules
- Logs and analysis
- Prevention and operations
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.