🌐 Building a Network Intrusion Detection Lab Using Suricata (With Real Attack Simulation)

🚀 Introduction

After successfully building a SOC lab using Wazuh, I wanted to go one step further — detecting actual network-level attacks. For this, I implemented Suricata, a powerful open-source Intrusion Detection System (IDS), and integrated it into my lab to monitor live traffic and detect malicious activities.

This project helped me understand how network threats are identified in real time and how IDS tools work behind the scenes.

🎯 Project Objective

The main goals of this project were:

• Monitor real-time network traffic
• Detect malicious activities such as port scanning
• Generate alerts based on predefined rules
• Integrate IDS logs into a SIEM system for analysis

🧩 Lab Architecture

I extended my existing lab:

• Kali Linux — Attacker machine
• Ubuntu Server — Suricata IDS + Wazuh Manager
• Windows 10 — Target machine
• Suricata — Network traffic monitoring
• Wazuh SIEM — Log analysis and visualization

⚙️ Setup Process

1️⃣ Installing Suricata

I installed Suricata on the Ubuntu server:

sudo apt install suricata

Then verified the installation and checked available network interfaces.

2️⃣ Configuring Network Interface

I identified my active interface:

ip a

In my case, it was:

ens33

Then ran Suricata:

sudo suricata -i ens33 -v

3️⃣ Generating Traffic

To test detection, I used Kali Linux:

nmap -sS -A <target-ip>

This generated real network traffic and simulated an attack scenario.

🚨 Challenges I Faced & How I Solved Them

🔴 1. No Output in Suricata Logs

Problem: Even after running Suricata, no logs appeared.

Root Cause: No traffic or incorrect interface

Solution:

• Verified correct interface (ens33)
• Generated traffic using Nmap
• Confirmed packet capture started

🔴 2. Suricata Logs Too Complex

Problem: The eve.json file contained too much data and was difficult to analyze.

Observation:

"event_type": "flow"

These logs were large and not useful for SIEM integration.

🔴 3. Wazuh Integration Failure

Problem: When integrating Suricata logs with Wazuh, I encountered:

Too many fields for JSON decoder

Root Cause: Suricata was sending excessive log data (flows, DNS, HTTP, etc.)

✅ Solution (Critical Fix)

I modified Suricata configuration:

sudo nano /etc/suricata/suricata.yaml

Changed:

types:
  - alert

This ensured only relevant security alerts were generated.

🔴 4. eve.json Not Creating

Problem: After deleting old logs, eve.json did not appear.

Solution:

• Realized Suricata only writes logs when traffic exists
• Triggered traffic again using Nmap
• File was generated automatically

🔴 5. No Alerts in Dashboard

Problem: Even after integration, no alerts appeared in Wazuh UI.

Solution:

• Checked filtering issues
• Verified logs in:
• /var/ossec/logs/alerts/alerts.json
• Confirmed Suricata logs were being processed

📊 Monitoring and Results

After successful configuration, I was able to detect:

• Nmap scanning activity
• Suspicious network behavior
• Unauthorized probing attempts

Example log:

ET SCAN Nmap User-Agent Observed

These alerts were visible in real time and categorized for analysis.

🧠 Key Learnings

This project gave me deep insights into:

• How IDS tools analyze packet-level data
• Difference between raw traffic logs and alert-based logs
• Importance of log optimization for SIEM systems
• Real-world troubleshooting in security tool integration
• Network visibility and detection techniques

💼 Skills Gained

• Intrusion Detection System (IDS) configuration
• Network traffic analysis
• Nmap attack simulation
• SIEM integration (Suricata + Wazuh)
• Log filtering and optimization

🔥 Final Outcome

At the end of this project:

✔ Successfully deployed Suricata IDS ✔ Detected real-time network attacks ✔ Integrated IDS with SIEM ✔ Built a complete detection pipeline

🎯 Conclusion

This project showed me that detection is not just about tools — it’s about understanding data.

Raw logs are noisy. Real security comes from filtering what matters.

🚀 What’s Next?

• Automating response (block attacker IPs)
• Advanced threat detection rules
• Threat intelligence integration

💬 Final Thought

If you want to learn cybersecurity:

Don’t just read about attacks. Simulate them. Detect them. Fix them.

That’s how you grow.

CyberSecurity #Suricata #IDS #NetworkSecurity #Nmap #SIEM #Wazuh #BlueTeam #CyberLab