We need to start with the basics and discuss what
exactly is the role that Suricata plays,
along with reviewing some key terms and concepts.
Suricata is a high‑performance network security monitoring engine,
with IDS and IPS as two major modes of operation.
High performance means that it can handle high volumes of traffic
on some of the busiest networks in the world.
Suricata is open source.
You can find the source code on GitHub,
as well as install it on many operating systems using pre‑built binary packages.
While many may think of Suricata as just an IDS,
that is, something that generates alert,
it does a lot more. It produces a considerable amount of metadata and
other useful information that provides a high level of situational
awareness in the networks you are monitoring.
This enables you to catch anomalies, identify malicious behavior,
and perform threat hunting, all with open source software.
Network security monitoring is an approach to collect network traffic to provide
immediate alerting and long‑term analysis through visualization and other tools
that can provide insight into the data generated.
Even with the growing use of TLS,
monitoring your network is key to understanding
what is happening on your systems.
Suricata plays a key role in developing an effective
approach to network security monitoring.
While this can be accomplished with a single Suricata censor,
due to how your network is laid out,
it often requires multiple sensors to get the coverage you need.
You also have to consider what to do with the logs.
Do you leave them on the sensor and analyze them there,
or ship them to a central server for aggregation and later analysis?
We'll touch on common deployment scenarios,
as well as how to integrate Suricata into an
Elastic Stack later into this course.
Suricata plays a key role in generating this valuable data,
the logs that contain things such as events,
metadata and protocol information, and alerts.
Keep in mind that exactly what data is generated is ultimately up to.
You don't need alerts?
You can disable those entirely.
And one of the key objectives of this course is that you get
familiar with all of the data that Suricata generates,
as well as how to configure it to operate in the desired state that you need.
So what can Suricata do?
Well, the list is actually quite long,
so we'll just touch on a few key capabilities here.
First, Suricata uses a YAML file for configuration,
which aligns with many popular projects.
This makes it easy to change how Suricata behaves.
It also produces output and JSON format,
which makes for integration, such as with an Elastic Stack,
much easier.
Suricata's multithreaded to help with performance.
In high‑traffic networks, you can also look into hardware acceleration.
There is native IPv6 support and auto‑protocol detection,
which makes identifying traffic easier.
For example, Suricata can detect a TLS session,
regardless of what port it is over.
Suricata has advanced support for application layer protocols such as HTTP,
HTTP/2, DNS, SMTP, TLS, and many more.
Suricata can perform file extraction on live traffic
over a variety of supported protocols, such as HTTP and SMB.
This is in addition to Suricata's ability to identify
and produce file information events,
which include such information as File Magic and the file hash.
Netflow output is also available, although it is disabled by default.
To continue our capabilities review,
Suricata is extensible through Lua scripting,
which provides you with the ability to add more complex
logic to your network inspection.
Suricata can utilize IP lists for blocking, based on reputation or geolocation.
Bypass rules are also available.
These deal with large flows, also known as elephant flows,
such as streaming services.
Why waste precious compute time on the latest episode of the Mandalorian?
Community ID is an emerging industry standard for
correlating data between different tools,
such as Suricata and Zeek.
JA3/JA3S hashes can be produced to provide a fingerprint from TLS sessions.
This can allow you to apply rules based on these hashes,
as well as hunting your network traffic.
Suricata is being continuously expanded to support a variety of
SCADA protocols and provides the ability to record your network
traffic via full packet capture.
These are just some of the main features.
There's more detailed explanation in the online documentation.
Let's now take a look at two of the main modes of operation.
IDS and IPS are two acronyms you will hear used,
not only throughout this course,
but also throughout industry. At times, they will be used interchangeably,
but they actually represent two very different modes that
a tool like Suricata can operate in.
I also want to stress that Suricata provides a wealth of
information, even when it doesn't run in either of these modes, as
it can still generate valuable data that you can monitor to
understand what is going on in your networks.
IDS stands for intrusion detection system.
This is a passive mode of operation and is the most common way of
deploying Suricata. In this mode, Suricata monitors network traffic,
generating metadata and alerts as appropriate.
It does not do anything to prevent or block traffic though. This means that it
is generally implemented in an out‑of‑band setup. It receives a copy of the
network traffic to monitor through a span or tap.
This mode allows Suricata to also operate as a network monitor.
IPS is intrusion prevention system.
This is an active mode, in which the rules used to generate alerts can also
be used to instruct Suricata to drop network traffic.
This gives Suricata the ability to prevent activity
that is unwanted on the network.
In this mode, Suricata is generally implemented in line. Traffic has
to flow through it in order for Suricata to have the ability to drop
it. In this mode, Suricata is not only monitoring the traffic and
generating metadata but also controlling more of what is allowed
within the network.
There are a number of techniques for monitoring network traffic and,
in particular, generating alerts, or otherwise drawing a security
team's attention to a specific event.
Suricata is a signature‑based engine. That is,
it relies on a list of preconfigured rules to help it understand what is
abnormal or undesirable behavior. Rules are written using a special rules
syntax, in which Suricata will match traffic against these rules and generate
an alert if they match. In IPS mode, these rules inform Suricata to drop
traffic, in addition to alerting. Rules are quite varied and can contain a
number of ways to match on traffic,
such as by specific IPs, ports, or protocols. For example,
let's say you don't want FTP in your environment. You can write a rule
to tell Suricata to drop all of this traffic. Rules can define
patterns and specific protocols. For example,
a rule can be written to detect on a known malware family's command and
control patterns. User activity can also be watched more closely.
Downloading executable content, for example,
can be detected to help you stay one step ahead of the criminals.
These are just some of the basics and important concepts that we'll
build off of as we progress through this course.
We're now ready to dive into the training VM and make sure that you're
all set for the hands‑on portions of this course.