Mastering Suricata: From Setup to Advanced Threat Detection

Suricata is an open-source IDS/IPS and network monitoring engine widely used in enterprise security. I installed, configured, and tested Suricata on a Linux machine, integrated it with Wazuh and SIEM tools, and created real-world detection and prevention rules.

This post details the step-by-step labs I performed, including commands, configurations, and results.

1. Install Suricata and Verify Rule Loading

First, I installed Suricata:

sudo apt update
sudo apt install suricata jq -y

Verify the configuration and rules:

sudo suricata -T -c /etc/suricata/suricata.yaml

I also confirmed the default logging location:

cat /etc/suricata/suricata.yaml | grep default-log-dir
# Default: /var/log/suricata

2. Capture Live Alerts in IDS Mode

I ran Suricata in IDS mode to monitor network traffic:

sudo suricata -c /etc/suricata/suricata.yaml -i eth0

To see live alerts in JSON format:

tail -f /var/log/suricata/eve.json | jq .

Then, I tested with a simple ping:

ping -c 2 8.8.8.8

If ICMP rules are enabled, you’ll see alerts logged in eve.json.

3. Write a Rule to Detect Visits to YouTube

Custom rules are where Suricata shines. I created a rule in /etc/suricata/rules/local.rules:

alert http any any -> any any (msg:"YouTube Access Detected"; content:"youtube.com"; http_host; sid:1000002; rev:1;)

Update the Suricata config to include local.rules if not already:

# In suricata.yaml:
rule-files:
  - suricata.rules
  - local.rules

Reload rules without restarting the engine:

sudo kill -USR2 $(pidof suricata)

Test by visiting YouTube:

curl -I https://www.youtube.com

Check alerts:

jq 'select(.alert)' /var/log/suricata/eve.json | grep "YouTube"

4. Block Traffic to Facebook in IPS Mode

Switch Suricata to IPS mode using NFQUEUE:

sudo iptables -I FORWARD -j NFQUEUE --queue-num 0
sudo suricata -c /etc/suricata/suricata.yaml --af-packet

Create a blocking rule:

drop http any any -> any any (msg:"Blocking Facebook Access"; content:"facebook.com"; http_host; sid:1000003; rev:1;)

Reload rules and test:

sudo kill -USR2 $(pidof suricata)
curl -I https://www.facebook.com

The connection will be blocked, and Suricata logs will record a drop event.

5. Analyze Suricata Logs and Extract Top Alerts

Suricata generates rich logs in eve.json. I used jq and awk to extract and analyze alerts:

Top triggered rules:

jq -r 'select(.alert) | .alert.signature' /var/log/suricata/eve.json | sort | uniq -c | sort -nr | head

Top source IP addresses:

jq -r 'select(.alert) | .src_ip' /var/log/suricata/eve.json | sort | uniq -c | sort -nr | head

Top destination ports:

jq -r 'select(.alert) | .dest_port' /var/log/suricata/eve.json | sort | uniq -c | sort -nr | head

These insights helped prioritize alerts and identify the most common events in my lab.

6. Integrate Suricata with ELK Stack or Splunk

ELK Integration

I configured Filebeat to ship Suricata logs to ELK:

sudo apt install filebeat -y
sudo nano /etc/filebeat/filebeat.yml

Added this section to monitor Suricata logs:

- type: log
  paths:
    - /var/log/suricata/eve.json
  json.keys_under_root: true
  json.add_error_key: true

Start Filebeat and view logs in Kibana:

sudo systemctl enable filebeat
sudo systemctl start filebeat

Splunk Integration

Alternatively, I configured Splunk Universal Forwarder:

/opt/splunkforwarder/bin/splunk add monitor /var/log/suricata/eve.json
/opt/splunkforwarder/bin/splunk restart

In Splunk, I built dashboards showing:

• Top alerts by signature
• Top source IPs
• Alert trends over time

7. Bonus: Integration with Wazuh

Finally, I added Suricata events into Wazuh for centralized security visibility.

Install the Wazuh agent and configure Suricata log monitoring in ossec.conf:

<localfile>
  <log_format>json</log_format>
  <location>/var/log/suricata/eve.json</location>
</localfile>

Restart the agent:

sudo systemctl restart wazuh-agent

Now, Suricata alerts are visible in the Wazuh dashboard for correlation and incident response.

Key Results

Through these labs, I successfully:

• Installed and configured Suricata on Linux.
• Captured live alerts in IDS mode.
• Wrote custom detection rules (e.g., YouTube).
• Blocked traffic with IPS mode (e.g., Facebook).
• Analyzed logs using command-line tools.
• Integrated Suricata with ELK, Splunk, and Wazuh for centralized monitoring.

This project demonstrates end-to-end mastery of Suricata and its use in real-world security operations.