In this clip,
we're going to discuss open‑source rule sets and how
to leverage them with Suricata.
Open‑source rule sets are pre‑written rule sets provided
by information security organizations.
These rules are written by the organizations or compiled
from communities who write them to detect specific
potential threats to your networks.
They're available for download from the rule sources and are free
for use and modification to fit your environment.
Using open‑source rule sets allows us to quickly configure
Suricata to detect a wide variety of threats.
We can observe the impact of these rule sets and make
modifications to fit our specific network environment.
If we detect a large number of false positives from a particular rule,
we can deactivate single rules or entire sets to fit our purpose.
We can also use the pre‑written rules as a template for
our own custom versions to detect new threats or track
similar protocols in our network.
To leverage open‑source rules with Suricata,
we'll use suricata‑update to select the appropriate rule
sources and then download the desired rule sets.
Once we configure Suricata with our new rule set,
it will evaluate incoming traffic against the new rules and
then take the predefined action on each match.
Now that we understand how open‑source rule sets fit in our
environment and how we'll use them to achieve our desired goals,
we're ready to evaluate the open‑source rule set we already
installed. In the next demo,
we're going to explore the emerging threats rule set and discuss
different categories of rules and attacks they can detect.