tips:suricata-eve-unixsocket
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
tips:suricata-eve-unixsocket [2020/08/27 19:05] – [2. Installing Suricata] navaneeth | tips:suricata-eve-unixsocket [2020/09/28 17:22] (current) – navaneeth | ||
---|---|---|---|
Line 21: | Line 21: | ||
</ | </ | ||
- | ==== 3. Installing Emerging Threat Rules 5.0 ==== | ||
+ | ==== 3. Updating with latest ruleset ==== | ||
- | * You have to install | + | Use the following command |
- | * Download and install Emerging Threats Open rules into /// | + | |
- | < | + | < |
- | #wget https://rules.emergingthreats.net/ | + | |
- | #tar xf emerging.rules.tar.gz | + | suricata-update puts the combined rules in '' |
- | </ | + | |
+ | < | ||
- | <note important> | ||
==== 4. Enabling EVE_unix Socket ==== | ==== 4. Enabling EVE_unix Socket ==== | ||
Line 46: | Line 45: | ||
</ | </ | ||
< | < | ||
- | |||
- | * And, also disable the ' | ||
- | |||
- | < | ||
- | # a line based alerts log similar to Snort' | ||
- | - fast: | ||
- | enabled: no | ||
- | filename: fast.log | ||
- | append: yes | ||
- | #filetype: regular # ' | ||
| | ||
Line 62: | Line 51: | ||
* Click on 'More options' | * Click on 'More options' | ||
* You will find a Dialog box with command line to install Suricata as below. | * You will find a Dialog box with command line to install Suricata as below. | ||
+ | * Cut and paste the command shown into a terminal to start suricata | ||
< | < | ||
Line 69: | Line 59: | ||
{{: | {{: | ||
- | <note important> | + | ==== 6. Viewing Alerts ==== |
{{: | {{: | ||
- | ==== 6. Updating with latest rules ==== | + | ==== 7. Starting Suricata Automatically |
- | If you have already installed suricata and you want to update with the latest rules. Use the following command. | + | * You need to install [[monit: |
- | < | + | * Add a shellscript named // |
+ | |||
+ | < | ||
+ | # | ||
+ | |||
+ | echo " | ||
+ | /bin/rm -f / | ||
+ | |||
+ | echo " | ||
+ | /usr/bin/suricata --user trisul -l / | ||
+ | |||
+ | echo "Done starting suricata"</ | ||
+ | |||
+ | * Make sure the shell script // | ||
+ | < | ||
+ | |||
+ | * You need to add the following statements in the /// | ||
+ | < | ||
+ | start program = "/ | ||
+ | </ | ||
+ | |||
+ | * Please ensure you restart monit | ||
+ | < | ||
tips/suricata-eve-unixsocket.1598535325.txt.gz · Last modified: 2020/08/27 19:05 by navaneeth