---

Suricata is a high-performance network IDS, IPS, and network security monitoring engine. Multi-threaded, protocol-aware, and capable of real-time intrusion detection and prevention.

---

Basic Usage

• suricata -c suricata.yaml -i eth0 - Run on interface

• suricata -c suricata.yaml -r file.pcap - Analyze pcap

• suricata -c suricata.yaml -T - Test configuration

• suricata -c suricata.yaml -v - Verbose mode

• suricata -c suricata.yaml -S rules.rules -i eth0 - Custom rules

---

Options

• -c config - Configuration file

• -i interface - Network interface

• -r file - Read from pcap file

• -T - Test configuration

• -v - Verbose output

• -S file - Rules file

• -l directory - Log directory

• -D - Run as daemon

• -u user - Run as user

• -g group - Run as group

---

Configuration

• /etc/suricata/suricata.yaml - Main configuration

• /etc/suricata/rules/ - Rules directory

• /var/log/suricata/ - Log directory

• /var/lib/suricata/ - Data directory

---

Rule Management

• suricata-update - Update rules

• suricata-update list-sources - List rule sources

• suricata-update enable-source et/open - Enable source

• suricata-update update-sources - Update sources

• suricata-update -f - Force update

---

Log Files

• /var/log/suricata/eve.json - JSON event log

• /var/log/suricata/fast.log - Fast alert log

• /var/log/suricata/stats.log - Statistics log

• /var/log/suricata/http.log - HTTP log

• /var/log/suricata/tls.log - TLS log

---

Common Examples

Test Configuration

suricata -c /etc/suricata/suricata.yaml -T

Validate configuration file.

Run on Interface

suricata -c /etc/suricata/suricata.yaml -i eth0

Start monitoring interface.

Analyze PCAP

suricata -c /etc/suricata/suricata.yaml -r capture.pcap

Analyze captured traffic.

Update Rules

suricata-update

Update detection rules.

View Alerts

tail -f /var/log/suricata/fast.log

Monitor alerts in real-time.

JSON Events

jq '.alert' /var/log/suricata/eve.json

Parse JSON event log.

Service Management

systemctl start suricata
systemctl status suricata

Manage as systemd service.

---

Rule Syntax

• alert action protocol src port -> dst port (options) - Basic rule

• msg - Alert message

• sid - Signature ID

• rev - Revision number

• content - Pattern to match

• pcre - Perl-compatible regex

---

Tips

• Always test configuration with -T before running

• Update rules regularly with suricata-update

• Monitor eve.json for comprehensive event data

• Use IPS mode for active blocking (requires proper setup)

• Configure log rotation for large deployments

• Fine-tune rules for your environment

• Monitor performance and adjust threads

• Essential for network security monitoring