Collaborate Disseminate
On our company network, suricata just raised the following (single) alert:
{
"timestamp": "2024-01-05T12:42:28.511703+0100",
"flow_id": 1276412390854359,
"in_iface": "igb0",
… Continue reading ThreatFox alert on Cloudflare IP
Reading through Suricata/Snort IDS rules, I can see examples such as below, and scratching my head to understand how is it feasible that a connection from home_network to external_network can have a flow direction to_client? I thought:
ho… Continue reading Snort / Suricata rules from HOME_NET with rule option flow:to_client
I configured suricata.yaml file to detect intrusion in any interface and it works well without NordVPN.
When I test Suricata by visiting:
curl http://testmynids.org/uid/index.html
Result of sudo tail /var/log/suricata/fast.log | grep 2100… Continue reading Suricata IDS not working with NordVPN connected
I’m thinking of using Suricata or Snort.
I can’t do anything myself, so I’m going to ask a freelance security engineer to do it.
If the engineer is skilled, once suricata or snort is set up, will it work fine in one setup?
at the moment,th… Continue reading What kind of engineers should I look for to implement Suricata or Snort?
I have a pattern that goes like this:
Starts with |00|, is followed by a variable number of ASCII characters in uppercase that can have at most length 22, followed by 12 |00| bytes, followed by 6 random bytes, followed by an md5 hash, foll… Continue reading Can I use pcres in Suricata for UDP traffic?
Manuals say modern Suricata supports decoding GRE/MPLS/etc by default. My config file uses all the CPU cores with normal traffic. However, during analyzing MPLS traffic only 1 core is 100% busy and all other are only 0-1% . stats.log rows … Continue reading Suricata 6.x not decoding MPLS packets
My Suricata IDS is generating this alert when starting Thunderbird:
ET INFO Observed DNS Query to .cloud TLD
You can analyze a json log:
{
"_index": "suricata-1.1.0-2022.02.11",
"_type": "_doc",… Continue reading I am noticing a malicious DNS query in Thunderbird
I’m in my last year of university and for my honour’s project I am tasked with comparing two intrusion detection systems, snort and suricata, hosted on a virtual machine on my PC.
As I have no access to networking devices such as switches … Continue reading What is the best way to create a PCAP file containing malicious traffic?
In our Suricata (version 6.0.4) logs we find many alerts messages like [1:2210045:2] SURICATA STREAM Packet with invalid ack [Classification: Generic Protocol Command Decode].
These come from the following rule:
alert tcp any any -> any… Continue reading How can I find out what rule option "stream-event:pkt_invalid_ack" means in Suricata? [closed]
I can’t figure it out / understand. Need to write a rule that catches an HTTP POST request from one ip address more than three times in 10 seconds and logs it.
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP post packet fl… Continue reading suricata http rule to identify POST requests