Protecting your network with the Suricata intrusion detection system
Conclusion
IDS and IPS systems are generally difficult to set up and maintain. If you don't tune your rules, you can get a lot of false positives, which might block legitimate traffic or mask an actual attack in the flood of alerts. However, the upside is significant; you can block attacks in real time (using IPS mode) and provide alerts of outgoing attacks (indicating compromised internal hosts). Additionally, certain types of data (such as TLS/SSL certificate logs) do not take up a lot of space and can provide invaluable insight later, when attacks occur and information about malware becomes available. Once network traffic is gone, it's gone forever. Unless you record it, chances are you'll never be able to reconstruct what truly happened.
Infos
- Suricata: http://suricata-ids.org/
- Suricata Installation: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricata_Installation
- PulledPork: https://code.google.com/p/pulledpork/downloads/list
- Suricata IPS Setup: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux
- Barnyard2: https://github.com/firnsy/barnyard2
- libhtp: https://github.com/ironbee/libhtp
- Suricata File Extraction: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File_Extraction
- pyinotify: https://github.com/seb-m/pyinotify
- Security Lessons: Spoofed Browsers: http://www.linux-magazine.com/w3/issue/114/054-055_kurt.pdf
- Mozilla Included certificate authorities: https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/
- Blocklists of Suspected Malicious IPs and URLs: http://zeltser.com/combating-malicious-software/malicious-ip-blocklists.html
- Snorby: https://snorby.org/
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
US / Canada
UK / Australia
Direct Download
Read full article as PDF:
Price $2.95
News
-
LibreOffice 7 Now Available
The LibreOffice 7 office suite is now available with important compatibility improvements.
-
Microsoft Brings procmon to Linux
The creators of Windows have brought the sysinternals procmon tool to the open source operating system.
-
New KDE Slimbook Available
The makers of the KDE Slimbook have released a Ryzen-4000 powered laptop.
-
PinePhone Now Offers a Convergence Package
The makers of the Linux PinePhone are now offering a model that makes desktop/mobile convergence a reality.
-
Flutter is Coming to Linux
Google and Canonical have joined forces to bring Flutter to the Linux desktop.
-
Purism Launches a Mini PC
The makers of the Librem line of Linux-based laptops have released a mini PC.
-
openSUSE Leap 15.2 Adds AI Machine Learning
With the new release of openSUSE Leap comes some exciting new features, including machine learning.
-
Google’s Nearby Sharing Could Work with Linux
Google’s answer to Apple’s AirDrop feature is rumored to work with the Linux desktop.
-
System76 Launches Ryzen-Powered Laptop
The new System76 Serval WS includes a powerful AMD Ryzen CPU.
-
Linux Mint Drops Snap
Linux Mint has officially dropped their support for Canonical’s snap packages.