In this demo,
we're going to use cron to schedule regular updates on our Suricata server.
We have two goals from Globomantics for this demo.
First,
we need to automate the update process to ensure that we regularly
receive the latest rule sets from our rule sources.
Second, we need to schedule the updates using an automated tool.
To accomplish this,
we're going to set up a cron job with a reload command to obtain
the new rule sets and reload the Suricata rules.
Let's head over to our Suricata server and get started.
To simulate our live environment and achieve all of Globomantics' goals,
we first have to start Suricata with our current rule set.
We'll do that using screen.
Now that it's running, let's navigate back to our main screen.
To achieve the goal of minimizing impact,
Suricata has the capability to reload rules without disrupting its operation.
One way to achieve this is to enter the following command,
sudo kill ‑USR2 space $ and, in parentheses,
pidof space suricata.
The command sends a signal to Suricata to conduct the rule reload.
Let's check our server using screen ‑r.
And right here, we can see the rule reload process was triggered and completed.
Now we have everything we need to schedule our rules update.
Let's head back to our main window.
To create a cron job, we need to access the crontab.
To access it, we enter sudo crontab ‑e.
Within this file,
we have some example commands and instructions for creating cron jobs.
For our purpose here,
let's set up a cron job to run a few minutes in the future so we can verify
that we set up our cron job correctly. According to my Suricata server's
time, I can set the time to 58 minutes and 00 hours.
This will run 3 minutes from its future.
Next, we can follow that with three asterisk symbols.
These correspond to date of month, month,
and date of week . By entering in asterisk here instead,
we set it to run on any day at this time.
Next, we'll need our command.
This will be /user/local/bin/suricata‑update.
Next, we need our reload command.
We enter that after the ‑‑reload‑command option.
Finally, we need to redirect this output and avoid being sent an email.
For that, we'll create a log file called suricata‑cron.log,
and we'll redirect standard error and standard output to this file.
Then we just save it, exit, and we wait for the cron job to execute.
All right, it should have run.
Let's check our Suricata command running on the other
screen to see if a reload executed.
And it looks like a reload did occur, although at a different time.
Let's check our Suricata cron log file.
And here, we do see that the cron job did, in fact, run.
But it may not have reloaded because it did not detect
any changes from that Suricata update.
To see if our rule reload works correctly,
let's try disabling one of these rule sources.
We'll disable the threat hunting rules.
Now go back into the crontab and change this to run a
few minutes in the future again.
Go ahead and exit out, and then we'll wait.
All right, our job should have finished.
Let's go check on our Suricata command.
And we do see a new rule reload starting and completed right on
schedule for our cron job. Let's go check the cron log.
And we have our new set of rules, and we see that it did, in
fact, run our reload command down here.
So the issue the first time was not with our configuration. It was
just simply that it didn't have any rule updates.
So our security goals were to automate the update process, which
we successfully did, and we used a tool that allows us to
schedule the time that our updates occur,
satisfying both of Globomantics' goals.
We also used the Suricata reload command to ensure that this
had minimal impact on Suricata's operation.
Before we close out of this,
let's just quickly re‑enable those threat hunting rules, and then we
need to go back to our screen session and close Suricata. Then we exit
from here, and then we'll run one last Suricata update to make sure
that the next time we log in, we have all the same rules that we loaded
from our rule sources. Coming up next, we'll wrap up the course with
the course summary and discuss the next steps in your Suricata learning
path.