It's now time to get into the training VM. You'll be provided
with a link and instructions to download the training VM and
the learning management system.
Once you have it imported into your favorite virtualization software,
you can power it on. This will bring you to a login screen, in which the
username is Suricata and the password is password.
The Suricata account gives you pseudo permissions, which means it is an
administrative account. First let's open a terminal.
We've added an icon for the Terminator program in the
application launch menu to the left of the screen.
By default,
you'll be in the suricarta user's home directory. From there,
all of the key resources will be available under the training
folder, so let's navigate there.
We'll get into all of this content in the next section. Right now, let's
just get Suricata to process some traffic. Using the command sudo
./suri‑replay‑pcap,sh, and then a relative path to a pcap in the pcaps
folder, I have set these pcaps up to follow along with the section and
the order in which I use them.
So for this pcap, we'll use demo‑s01, and this will
be the only pcap for this section.
This will replay the traffic in the pcap to a dummy interface that
Suricata is monitoring, which allows us to treat the pcap traffic as
if it were being monitored in real time.
Once this script finishes,
we will be presented with alerts, which will help us to
identify some of the key activity. There they are.
This pcap was from an Exploit Kit that dropped several malicious
artifacts so it created quite a bit of noise on the network. While
seeing these alerts in the terminal can be insightful, it usually
doesn't scale well, so let's move to our primary GUI tool, EveBox. On
the desktop, there is a shortcut item,
links‑helpful‑info.html. Double‑clicking this will open a browser and
provide you with a list of resources both in the training VM and some
externally. The main tool that we'll be using is EveBox.
You can now click on the link to open EveBox up in a new tab.
The default view is the Inbox, which allows you to triage alerts as
they come in. Here we can see that we actually had a number of
alerts that were generated multiple times.
Let's, just for example, investigate the first alert by clicking on it.
This next view allows us to get more granular information from the
relevant network traffic that the rule matched on. Here you can see
information such as the Source and Destination, Ports,
the Signature ID, and detailed information about the HTTP request response.
Suricata also generates a Flow ID. Let's now click
on that to see what it provides.
Remember I said Suricata generates events.
The Flow ID allows us to correlate all of the events from a
particular session, so it's like taking a step back from the alert
to get a bigger picture. Here we can see that there was a TCP
session established through a flow event,
then an HTTP GET request to a rather suspicious domain,
which caused the alert to be generated.
A FILEINFO event was also generated,
which can be items such as the raw HTML response to
files that traverse the network.
Even with just this data,
we have a wealth of information to begin piecing together what
happened to determine if we need to roll incident response or
if no further action is necessary.
This is just a brief demo to give you some ideas as to what Suricata can do
and what we'll be covering in this course. At this point,
the most important thing is that your training VM is up and running.
You can follow along with what I just did, and you're ready to learn.
Let's move on to the next section.