### Install Full Suricata Setup

Source: https://github.com/oisf/suricata/blob/main/doc/Basic_Setup.txt

This command combines 'install-conf' and 'install-rules' to provide a complete, ready-to-run Suricata installation with configured rules.

```bash
./configure && make && make install-full
```

--------------------------------

### SMB1 Session Setup Request/Response Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

Example showing the 'request' and 'response' fields for an SMB1 partial 'SESSION_SETUP_ANDX' command. This includes details about the client's and server's native OS and Lan Manager strings.

```json
"request": {
  "native_os": "Unix",
  "native_lm": "Samba 3.9.0-SVN-build-11572"
},
"response": {
  "native_os": "Windows (TM) Code Name \"Longhorn\" Ultimate 5231",
  "native_lm": "Windows (TM) Code Name \"Longhorn\" Ultimate 6.0"
}
```

--------------------------------

### Setup Suricata Beta PPA

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/install/ubuntu.md

Add the Suricata beta PPA to your system to install Release Candidate (RC) packages. Requires `sudo`.

```bash
sudo add-apt-repository ppa:oisf/suricata-beta
sudo apt-get update
sudo apt-get upgrade
```

--------------------------------

### Verify Installation Paths

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/upgrade.md

When installing from source, ensure you pass the same --prefix, --sysconfdir, --localstatedir, and --datadir options to configure as the currently installed version. This command snippet shows how to check the current build information for these paths.

```bash
$ suricata --build-info|grep -A 3 '\-\-prefix'
    --prefix                                 /usr
    --sysconfdir                             /etc
    --localstatedir                          /var
    --datarootdir                            /usr/share
```

--------------------------------

### Start Napatech Service

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/capture-hardware/napatech.md

Starts the Napatech service after driver installation, which is required for Suricata to utilize the hardware.

```bash
$ /opt/napatech3/bin/ntstart.sh -m
```

--------------------------------

### Setup Suricata Stable PPA

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/install/ubuntu.md

Add the Suricata stable PPA to your system to install the latest stable release. Requires `software-properties-common`.

```bash
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
```

--------------------------------

### Install Suricata Configuration

Source: https://github.com/oisf/suricata/blob/main/doc/Basic_Setup.txt

This command performs a regular 'make install' and then automatically creates/sets up all necessary directories and the suricata.yaml file.

```bash
./configure && make && make install-conf
```

--------------------------------

### Start Suricata Service

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/install/rpm.md

Use systemctl to start the Suricata service. Requires sudo privileges.

```default
sudo systemctl start suricata
```

--------------------------------

### Install libcap-ng

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/configuration/dropping-privileges.md

Download, compile, and install the libcap-ng library. This is a prerequisite for dropping privileges.

```bash
wget http://people.redhat.com/sgrubb/libcap-ng/libcap-ng-0.7.8.tar.gz
tar -xzvf libcap-ng-0.7.8.tar.gz
cd libcap-ng-0.7.8
./configure
make
make install
```

--------------------------------

### Install ethtool

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/performance/high-performance-config.md

Install the latest ethtool utility for NIC configuration. Ensure you use the recommended version for your NIC.

```default
wget https://mirrors.edge.kernel.org/pub/software/network/ethtool/ethtool-5.2.tar.xz
tar -xf ethtool-5.2.tar.xz
cd ethtool-5.2
./configure && make clean && make && make install
/usr/local/sbin/ethtool --version
```

--------------------------------

### Start Suricata with Custom Ring Sizes

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/capture-hardware/myricom.md

Launch Suricata with Myricom cards, explicitly setting large data and descriptor ring sizes using environment variables. This example uses 16 threads and custom ring sizes.

```bash
SNF_NUM_RINGS=16 SNF_DATARING_SIZE=17179869184 SNF_DESCRING_SIZE=4294967296 SNF_FLAGS=0x1 suricata -c suricata.yaml -i eth5 --runmode=workers
```

--------------------------------

### Start Suricata with AF_XDP Interface

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/capture-hardware/af-xdp.md

Starts Suricata using the AF_XDP capture method, specifying the network interface to monitor.

```bash
suricata --af-xdp=<interface>
suricata --af-xdp=igb0
```

--------------------------------

### NTLMSSP Complete Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

A more complete JSON example for NTLMSSP, showing domain, user, host, version, and request/response details.

```default
"smb": {
  "id": 3,
  "dialect": "NT LM 0.12",
  "command": "SMB1_COMMAND_SESSION_SETUP_ANDX",
  "status": "STATUS_SUCCESS",
  "status_code": "0x0",
  "session_id": 2048,
  "tree_id": 0,
  "ntlmssp": {
    "domain": "VNET3",
    "user": "administrator",
    "host": "BLU",
    "version": "60.230 build 13699 rev 188"
  },
  "request": {
    "native_os": "Unix",
    "native_lm": "Samba 3.9.0-SVN-build-11572"
  },
  "response": {
    "native_os": "Windows (TM) Code Name \"Longhorn\" Ultimate 5231",
    "native_lm": "Windows (TM) Code Name \"Longhorn\" Ultimate 6.0"
  }
}
```

--------------------------------

### Install clang-format and git-clang-format on Fedora

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/devguide/codebase/code-style.md

Installs the clang and git-clang-format packages on Fedora using dnf.

```bash
$ sudo dnf install clang git-clang-format
```

--------------------------------

### HTTP Request Line Detection

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/lua/lua-functions.md

Example detection script for HTTP request lines. It uses `suricata.http` to get transaction data and checks if the request line starts with 'GET'.

```lua
local http = require("suricata.http")

function init (args)
  return {}
end

function match(args)
  local tx, err = http.get_tx()
  http_request_line, err = tx:request_line()

  if #http_request_line > 0 then
      --GET /base64-hello-world.txt HTTP/1.1
      if http_request_line:find("^GET") then
          return 1
      end
  end

  return 0
end
```

--------------------------------

### Entropy Keyword Example with Equality

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/payload-keywords.md

An example demonstrating the basic usage of the entropy keyword to check for an exact entropy value match.

```default
entropy: 7.01
```

--------------------------------

### Full Auto-Setup Suricata

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/install.md

Installs Suricata, configures it, and sets up the ruleset, preparing it for immediate use.

```default
./configure && make && sudo make install-full
```

--------------------------------

### Open-Ended Port Range Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/intro.md

This example specifies a port range starting from 1024 up to the highest possible port number.

```suricata
[1024: ]
```

--------------------------------

### SMB Pipe Open Log Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

Example of an SMB 'CREATE' command log entry for opening a pipe. This entry includes details like transaction ID, dialect, status, session ID, and filename.

```json
"smb": {
  "id": 1,
  "dialect": "unknown",
  "command": "SMB2_COMMAND_CREATE",
  "status": "STATUS_SUCCESS",
  "status_code": "0x0",
  "session_id": 4398046511201,
  "tree_id": 1,
  "filename": "atsvc",
  "disposition": "FILE_OPEN",
  "access": "normal",
  "created": 0,
  "accessed": 0,
  "modified": 0,
  "changed": 0,
  "size": 0,
  "fuid": "0000004d-0000-0000-0005-0000ffffffff"
}
```

--------------------------------

### Match HTTP Method - GET

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/http-keywords.md

Use the http.method keyword to match the HTTP request method. This example specifically looks for GET requests.

```default
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP Request Example"; flow:established,to_server; http.method; content:"GET"; classtype:bad-unknown; sid:2; rev:1;)
```

--------------------------------

### Enable Suricata to Start on Boot

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/install/rpm.md

Configure Suricata to automatically start when the system boots using systemctl. Requires sudo privileges.

```default
sudo systemctl enable suricata
```

--------------------------------

### Entropy Keyword Example with All Options

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/payload-keywords.md

Demonstrates the usage of the entropy keyword with all possible options specified, including bytes, offset, and a specific entropy value.

```default
entropy: bytes 0, offset 0,  value = 4.037
```

--------------------------------

### HTTP GET Request Rule Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/intro.md

This rule matches HTTP GET requests containing 'rule' in the URI, originating from the home network and destined for the external network.

```suricata
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP GET Request Containing Rule in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"rule"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)
```

--------------------------------

### Suricata Rule for HTTP Request Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/http-keywords.md

An example Suricata signature that alerts on a specific HTTP GET request, inspecting method, URI, protocol, user agent, and host.

```default
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP Request Example"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/index.html"; bsize:11; http.protocol; content:"HTTP/1.1"; bsize:8; http.user_agent; content:"Mozilla/5.0"; bsize:11; http.host; content:"suricata.io"; bsize:11; classtype:bad-unknown; sid:25; rev:1;)
```

--------------------------------

### Fileinfo Event Offset Values Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

This example shows the offset values from a fileinfo event, illustrating how http content range start and end values are replicated in the fileinfo fields.

```default
http.content_range.raw: bytes 500-1000/146515
http.content_range.start: 500
http.content_range.end: 1000
http.content_range.size: 146515
fileinfo.start: 500
fileinfo.end: 1000
```

--------------------------------

### Bittorrent DHT Get Peers Request

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

Example of a Bittorrent DHT get_peers request message.

```default
"bittorrent_dht": {
  "transaction_id": "05e4",
  "client_version": "4c540126",
  "request_type": "get_peers",
  "request": {
    "id": "41aff1580119f074e2f537f231f12adf684f0d1f",
    "info_hash": "19a6fcfcba6cc2c6d371eb754074d095adb5d291"
  }
}
```

--------------------------------

### Example Flow Lifecycle Callbacks Implementation (C)

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/devguide/extending/flow-lifecycle-callbacks.md

Provides example implementations for flow init, update, and finish callbacks, along with a function to register them. These demonstrate basic logging for each lifecycle event.

```c
static void ExampleFlowInit(ThreadVars *tv, Flow *f, const Packet *p, void *user)
{
    SCLogNotice("flow initialized: %p", f);
}

static void ExampleFlowUpdate(ThreadVars *tv, Flow *f, Packet *p, void *user)
{
    SCLogNotice("flow updated: %p packet: %p", f, p);
}

static void ExampleFlowFinish(ThreadVars *tv, Flow *f, void *user)
{
    SCLogNotice("flow finished: %p", f);
}

static void ExampleInit(void)
{
    SCFlowRegisterInitCallback(ExampleFlowInit, NULL);
    SCFlowRegisterUpdateCallback(ExampleFlowUpdate, NULL);
    SCFlowRegisterFinishCallback(ExampleFlowFinish, NULL);
}
```

--------------------------------

### Example Match Function for HTTP GET Request

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/lua/libs/packetlib.md

A sample `match` function that iterates through packet payload lines to find an HTTP GET request. It logs details upon finding a match.

```lua
local logger = require("suricata.log")

function match (args)
    p = packet.get()
    payload = p:payload()
    ts = p:timestring()

    for line in payload:gmatch("([^
]*)[
]+") do
        if line == "GET /index.html HTTP/1.0" then
            ipver, srcip, dstip, proto, sp, dp = p:tuple()
            logger.notice(string.format("%s %s->%s %d->%d (pcap_cnt:%d) match! %s", ts, srcip, dstip, sp, dp, p:pcap_cnt(), line));
            return 1
        end
    end

    return 0
end
```

--------------------------------

### Compile Suricata from Source

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/install.md

Basic steps to download, extract, configure, compile, and install Suricata from its source code.

```default
tar xzvf suricata-8.0.3.tar.gz
cd suricata-8.0.3
./configure
make
make install
```

--------------------------------

### Get Server Certificate Not Before

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/lua/libs/tls.md

Retrieves the Unix timestamp indicating the validity start date of the server's certificate.

```APIDOC
## Get Server Certificate Not Before

### Description
Gets the Unix timestamp of the beginning of validity for the server's certificate.

### Method
`t:get_server_cert_not_before()`

### Returns
- `notbefore` (number): The Unix timestamp when the certificate becomes valid, or nil if not available.
```

--------------------------------

### Install Rust and Related Tools

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/install.md

Instructions for installing Rust, cbindgen, and configuring the PATH for Rust development, especially when distribution packages are insufficient.

```default
1) Install Rust https://www.rust-lang.org/en-US/install.html
2) Install cbindgen - if the cbindgen is not found in the repository
   or the cbindgen version is lower than required, it can be
   alternatively installed as: cargo install --force cbindgen
3) Make sure the cargo path is within your PATH environment
   echo 'export PATH="~/.cargo/bin:${PATH}" >> ~/.bashrc
   export PATH="~/.cargo/bin:${PATH}"
```

--------------------------------

### Get Client Certificate Not Before

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/lua/libs/tls.md

Retrieves the Unix timestamp indicating the validity start date of the client's certificate.

```APIDOC
## Get Client Certificate Not Before

### Description
Gets the Unix timestamp of the beginning of validity for the client's certificate.

### Method
`t:get_client_cert_not_before()`

### Returns
- `notbefore` (number): The Unix timestamp when the certificate becomes valid, or nil if not available.
```

--------------------------------

### Setup Suricata Daily PPA

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/install/ubuntu.md

Add the Suricata daily PPA for testing packages from the latest git development repository. This may be unstable. Requires `sudo`.

```bash
sudo add-apt-repository ppa:oisf/suricata-daily-allarch
sudo apt-get update
sudo apt-get upgrade
```

--------------------------------

### Flow Variable Example: Increment Counter

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/lua/libs/flowvar.md

This example demonstrates how to get a flow variable, read its current value, increment it if it exists, or initialize it to 1 if it doesn't, and then set the new value. The value is returned as a string and its length is also provided.

```lua
local flowvarlib = require("suricata.flowvar")

function init ()
    flowvarlib.register("count")
    return {}
end

function thread_init ()
    count_var = flowvarlib.get("count")
end

function match ()
    local value = count_var:value()
    if value == nil then
        -- Initialize value to 1.
        value = tostring(1)
        count_var:set(value, #value)
    else
        value = tostring(tonumber(value) + 1)
        count_var:set(value, #value)
    fi

    -- Return 1 or 0 based on your own logic.
    return 1
end
```

--------------------------------

### Install Suricata Library and Headers

Source: https://github.com/oisf/suricata/blob/main/examples/lib/custom/README.md

Commands to install the Suricata library and headers, necessary for building a standalone application against the Suricata library.

```bash
make install-library
make install-headers
```

--------------------------------

### Bittorrent DHT Get Peers Response with Nodes

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

Example of a Bittorrent DHT get_peers response message including peer 'nodes'.

```default
"bittorrent_dht": {
  "transaction_id": "44e6",
  "response": {
    "id": "19a7c8f4f6d14d9f87a67671720633e551f30cb7",
    "values": [
      {
        "ip": "45.22.252.153",
        "port": 36798
      },
      {
        "ip": "94.41.206.37",
        "port": 30850
      },
      {
        "ip": "84.228.120.50",
        "port": 6881
      },
      {
        "ip": "178.81.206.84",
        "port": 12373
      },
      {
        "ip": "110.188.93.186",
        "port": 22223
      }
    ],
    "token": "c897ee539e02a54595b4d7cfb6319ad48e71b282"
  }
}
```

--------------------------------

### Start Ruleset Profiling

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rule-management/rule-profiling.md

Use this command to begin collecting ruleset performance data. Ensure Suricata is built with `--enable-profiling-rules`.

```bash
suricatasc -c ruleset-profile-start
```

--------------------------------

### Build Documentation with Sphinx

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/README.md

Use this command to build the documentation locally. Substitute 'html' with your desired output format (e.g., pdf, man).

```bash
make -f Makefile.sphinx html
```

--------------------------------

### Bittorrent DHT Get Peers Response with Values

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

Example of a Bittorrent DHT get_peers response message including peer 'values'.

```default
"bittorrent_dht": {
  "transaction_id": "05e4",
  "client_version": "555462d6",
  "response": {
    "id": "19a6f98be177e32e7b5bd77276d529f03e3ba8a9",
    "values": [
      {
        "ip": "45.238.190.2",
        "port": 6881
      },
      {
        "ip": "185.70.52.245",
        "port": 51215
      },
      {
        "ip": "45.21.238.247",
        "port": 55909
      },
      {
        "ip": "62.28.248.195",
        "port": 6881
      }
    ],
    "token": "c17094641ca8844d711120baecb2b5cf25435614"
  }
}
```

--------------------------------

### MQTT CONNECT Logging Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

This example demonstrates the EVE-JSON structure for an MQTT CONNECT message, including protocol details, flags, client ID, and optional username, password, will, and properties. Passwords are only logged if the 'mqtt.passwords: yes' configuration is enabled.

```default
"connect": {
  "qos": 0,
  "retain": false,
  "dup": false,
  "protocol_string": "MQTT",
  "protocol_version": 5,
  "flags": {
    "username": true,
    "password": true,
    "will_retain": false,
    "will": true,
    "clean_session": true
  },
  "client_id": "client",
  "username": "user",
  "password": "pass",
  "will": {
    "topic": "willtopic",
    "message": "willmessage",
    "properties": {
      "content_type": "mywilltype",
      "correlation_data": "3c32aa4313b3e",
      "message_expiry_interval": 133,
      "payload_format_indicator": 144,
      "response_topic": "response_topic1",
      "userprop": "uservalue",
      "will_delay_interval": 200
    }
  },
  "properties": {
    "maximum_packet_size": 11111,
    "receive_maximum": 222,
    "session_expiry_interval": 555,
    "topic_alias_maximum": 666,
    "userprop1": "userval1",
    "userprop2": "userval2"
  }
}
```

--------------------------------

### Full Rule Example with Tagging

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/tag.md

Demonstrates how to incorporate the tag keyword within a complete Suricata rule, showing both session and host tagging.

```default
alert dns any any -> any any (dns.query; content:"evil"; [tag:host,60,seconds,src](tag:host,60,seconds,src); sid:1;)
```

```default
alert http any any -> any any (http.method; content:"POST"; [tag:session](tag:session); sid:1;)
```

--------------------------------

### Bittorrent DHT Get Peers Request (Nodes Param)

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

Example of a Bittorrent DHT get_peers request message, showing the 'nodes' parameter.

```default
"bittorrent_dht": {
  "transaction_id": "44e6",
  "client_version": "4c540126",
  "request_type": "get_peers",
  "request": {
    "id": "41aff1580119f074e2f537f231f12adf684f0d1f",
    "info_hash": "19a6fcfcba6cc2c6d371eb754074d095adb5d291"
  }
}
```

--------------------------------

### Initialize for Protocol Data (Output)

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/lua/lua-functions.md

Use this `init` function for output scripts that need specific protocol data, such as TLS.

```lua
function init (args)
    local needs = {}
    needs["protocol"] = "tls"
    return needs
end
```

--------------------------------

### Suricata DAG Interface Startup Log

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/capture-hardware/endace-dag.md

Example log output indicating that Suricata has successfully attached to and started processing packets from a DAG interface.

```log
[5570] 10/7/2012 -- 13:52:30 - (source-erf-dag.c:262) <Info> (ReceiveErfDagThreadInit) -- Attached and started stream: 0 on DAG: /dev/dag0
[5570] 10/7/2012 -- 13:52:30 - (source-erf-dag.c:288) <Info> (ReceiveErfDagThreadInit) -- Starting processing packets from stream: 0 on DAG: /dev/dag0
```

--------------------------------

### Get Client Certificate Validity Start (Not Before)

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/lua/libs/tls.md

Retrieve the Unix timestamp indicating when the certificate becomes valid. Useful for ensuring a certificate is currently active.

```lua
function log (args)
    notbefore = t:get_client_cert_not_before()
    if notbefore > os.time() then
        -- not yet valid certificate
    end
end
```

--------------------------------

### Suricata Command-Line with Capture Filter

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/performance/ignoring-traffic.md

Apply capture filters directly on the command line when starting Suricata. This example uses 'eth0' and ignores traffic to '1.2.3.4'.

```default
suricata -i eth0 -v not host 1.2.3.4
```

--------------------------------

### File-store v1 Configuration Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/file-extraction/config-update.md

This is an example of a file-store configuration in version 1. It shows the various options available before the v2 update.

```yaml
- file-store:
    enabled: yes        # set to yes to enable
    log-dir: files      # directory to store the files
    force-magic: no     # force logging magic on all stored files
    force-hash: [md5]   # force logging of md5 checksums
    force-filestore: no # force storing of all files
    stream-depth: 1mb   # reassemble 1mb into a stream, set to no to disable
    waldo: file.waldo   # waldo file to store the file_id across runs
    max-open-files: 0   # how many files to keep open (O means none)
    write-meta: yes     # write a .meta file if set to yes
    include-pid: yes    # include the pid in filenames if set to yes.

```

--------------------------------

### Initialize for Logging

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/lua/libs/http.md

Initialize the script to capture HTTP protocol details for logging purposes.

```lua
function init (args)
   local needs = {}
   needs["protocol"] = "http"
   return needs
end
```

--------------------------------

### SPAN Port Configuration Port Pairing

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/capture-hardware/napatech.md

Example of port pairing configuration for SPAN port setups where both upstream and downstream traffic are delivered to the same physical port.

```default
ports[0-0,1-1,2-2,3-3]
```

--------------------------------

### Initialization and Registration

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/lua/libs/flowint.md

Demonstrates how to load the flowint module, register a flow integer in the init method, and acquire a handle for it in the thread_init function.

```APIDOC
## Initialization and Registration

First, the `flowint` module must be loaded:

```lua
local flowintlib = require("suricata.flowint")
```

Then in the `init` method, any flow integers used in the script should be registered. This is optional and could be skipped if you know for sure the flow integers will be registered by some other means.

Example:

```lua
local flowintlib = require("suricata.flowint")

function init ()
    flowintlib.register("count")
    return {}
end
```

Finally, in the `thread_init` function a handle is acquired for the flow integers and stored as a global:

```lua
function thread_init ()
    count_flow_int = flowintlib.get("count")
end
```
```

--------------------------------

### Tap Configuration Port Pairing

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/capture-hardware/napatech.md

Example of port pairing configuration for tap setups where upstream and downstream traffic typically arrive on different physical ports.

```default
ports[0-1,2-3]
```

--------------------------------

### Start Suricata with Unix Socket

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/unix-socket.md

Initiate Suricata with a configuration file and enable the Unix socket for remote control.

```bash
suricata -c /etc/suricata-full-sigs.yaml --unix-socket
```

--------------------------------

### Suricata Rule Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/intro.md

A basic Suricata rule demonstrating the action, header, and options. This rule alerts on HTTP GET requests containing the word 'rule' in the URI.

```suricata
alert http $HOME_NET any -> $EXTERNAL_NET any  (msg:"HTTP GET Request Containing Rule in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"rule"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)
```

--------------------------------

### Match SNMP Trap Type

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/snmp-keywords.md

Use this snippet to match the SNMP Trap type. You can specify the type as an integer or a string. This example demonstrates matching a cold start trap.

```default
alert snmp any any -> any 162 (msg:"SNMP trap cold start"; snmp.pdu_type:trap_v1; snmp.trap_type:coldstart; sid:3; rev:1;)

```

--------------------------------

### RDP Logging with TLS Transition Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

Demonstrates an RDP session transitioning to TLS encryption, including initial request, response with protocol selection, and the TLS handshake.

```json
"rdp": {
  "tx_id": 0,
  "event_type": "initial_request",
  "cookie": "AWAKECODI"
}
```

```json
"rdp": {
  "tx_id": 1,
  "event_type": "initial_response",
  "server_supports": [
    "extended_client_data"
  ],
  "protocol": "hybrid"
}
```

```json
"rdp": {
  "tx_id": 2,
  "event_type": "tls_handshake",
  "x509_serials": [
    "16ed2aa0495f259d4f5d99edada570d1"
  ]
}
```

--------------------------------

### Get Server Certificate Validity Start (Not Before)

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/lua/libs/tls.md

Retrieve the Unix timestamp indicating when the server certificate becomes valid. This helps in verifying if the server's certificate is currently active.

```lua
function log (args)
    notbefore = t:get_server_cert_not_before()
    if notbefore > os.time() then
        -- not yet valid certificate
    end
end
```

--------------------------------

### SMTP Response Line Frame Inspection

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/smtp-keywords.md

Inspects a single line from the server to the client using the smtp.response_line frame. This example detects '354 go ahead' at the start of a response line.

```suricata
alert smtp any any -> any any ( frame:smtp.response_line; content:"354 go ahead"; startswith; sid:1;)
```

--------------------------------

### Tenant Specific Configuration Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/configuration/multi-tenant.md

Example of a tenant-specific YAML configuration file. This includes settings like default rule path, rule files, classification file, reference config file, and variable definitions for address and port groups.

```yaml
# Set the default rule path here to search for the files.
# if not set, it will look at the current working dir
default-rule-path: /etc/suricata/rules
rule-files:
  - rules1

# You can specify a threshold config file by setting "threshold-file"
# to the path of the threshold config file:
# threshold-file: /etc/suricata/threshold.config

classification-file: /etc/suricata/classification.config
reference-config-file: /etc/suricata/reference.config

# Holds variables that would be used by the engine.
vars:

  # Holds the address group vars that would be passed in a Signature.
  # These would be retrieved during the Signature address parsing stage.
  address-groups:

    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"

    EXTERNAL_NET: "!$HOME_NET"

    ...

  port-groups:

    HTTP_PORTS: "80"

    SHELLCODE_PORTS: "!80"

    ...
```

--------------------------------

### Subslice with Excessive Negative Offset and Nbytes (With Truncate)

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/transforms.md

When `truncate` is present, an excessive negative offset is reset to 0, and `nbytes` is applied from that point. This example starts at offset 0 and takes 5 bytes.

```default
subslice: -20, 5, truncate;
```

--------------------------------

### MQTT PUBLISH JSON Log Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

Example of logging for an MQTT PUBLISH message. Shows topic, message, QoS, and optional properties.

```default
"publish": {
  "qos": 1,
  "retain": false,
  "dup": false,
  "topic": "topic",
  "message_id": 1,
  "message": "baa baa sheep",
  "properties": {
    "content_type": "mytype",
    "correlation_data": "3c32aa4313b3e",
    "message_expiry_interval": 77,
    "payload_format_indicator": 88,
    "response_topic": "response_topic1",
    "topic_alias": 5,
    "userprop": "userval"
  }
}
```

--------------------------------

### FTP Event Logging with All Fields Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

This example demonstrates an FTP event log including all available fields, such as dynamic port, mode, and reply received status.

```default
"ftp": {
  "command": "EPRT",
  "command_data": "|2|2a01:e34:ee97:b130:8c3e:45ea:5ac6:e301|41813|",
  "reply": [
    "EPRT command successful. Consider using EPSV."
  ],
  "completion_code": [
    "200"
  ],
  "dynamic_port": 41813,
  "mode": "active",
  "reply_received": "yes"
}
```

--------------------------------

### Initialize Multiple Flowint Counters

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/flow-keywords.md

This example shows how to initialize two flowint variables, 'myvar' and 'maxvar', to specific values (1 and 6 respectively) when a 'GET' request is detected and the variables are not yet set.

```default
alert tcp any any -> any any (msg:"Setting a flowint counter"; content:"GET"; \
      flowint:myvar, notset; flowint:maxvar,notset;                           \
      flowint:myvar,=,1; flowint: maxvar,=,6;)
```

--------------------------------

### Match HTTP URI Length

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/http-keywords.md

An example Suricata rule using the urilen keyword to match a specific URI length. This rule alerts on HTTP GET requests with a URI length of exactly 11.

```suricata
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP Request"; flow:established,to_server; urilen:11; http.method; content:"GET"; classtype:bad-unknown; sid:40; rev:1;)
```

--------------------------------

### Configure NIC for High Performance

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/performance/high-performance-config.md

Set up the network interface, including offloading and load balancing, for optimal performance. This involves disabling and re-enabling the interface, setting combined queues, enabling rxhash and ntuple offloads, setting IRQ affinity, and configuring hash functions and keys.

```bash
ifconfig eno6 down
/opt/mellanox/ethtool/sbin/ethtool -L eno6 combined 15
/opt/mellanox/ethtool/sbin/ethtool -K eno6 rxhash on
/opt/mellanox/ethtool/sbin/ethtool -K eno6 ntuple on
ifconfig eno6 up
/sbin/set_irq_affinity_cpulist.sh 1-7,64-71 eno6
/opt/mellanox/ethtool/sbin/ethtool -X eno6 hfunc toeplitz
/opt/mellanox/ethtool/sbin/ethtool -X eno6 hkey 6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A
```

--------------------------------

### SMTP Command Line Frame Inspection

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/smtp-keywords.md

Inspects a single line from the client to the server using the smtp.command_line frame. Multi-line commands are processed per line. This example detects 'MAIL FROM:' at the start of a command line.

```suricata
alert smtp any any -> any any ( frame:smtp.command_line; content:"MAIL|20|FROM:"; startswith; sid:1;)
```

--------------------------------

### Install ET Open Ruleset

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/quickstart.md

Fetches and installs the default ET Open ruleset using the `suricata-update` tool. This is the first step to enable Suricata's detection capabilities.

```default
sudo suricata-update
```

--------------------------------

### Start Suricata with Myricom (8 Threads)

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/capture-hardware/myricom.md

Launch Suricata with Myricom cards, setting the number of rings via SNF_NUM_RINGS and flags via SNF_FLAGS. This example uses 8 threads and default ring sizes.

```bash
SNF_NUM_RINGS=8 SNF_FLAGS=0x1 suricata -c suricata.yaml -i eth5 --runmode=workers
```

--------------------------------

### Format Rule Example with Emphasis

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/devguide/contributing/contribution-process.md

Demonstrates how to use the 'example-rule' container with the 'example-rule-emphasis' role to highlight specific parts of a rule signature.

```default
.. container:: example-rule

alert ssh any any -> any any (msg:"match SSH protocol version";
:example-rule-emphasis:`ssh.proto;` content:"2.0"; sid:1000010;)
```

--------------------------------

### Example C Parser Callback Implementation

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/devguide/extending/app-layer/parser.md

An example of a C function that adheres to the AppLayerParserFPtr prototype. This specific example is named HTPHandleRequestData.

```c
static AppLayerResult HTPHandleRequestData(Flow *f, void *htp_state,
        AppLayerParserState *pstate,
        const uint8_t *input, uint32_t input_len,
        void *local_data, const uint8_t flags);
```

--------------------------------

### Auto-setup Suricata Configuration

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/devguide/codebase/installation-from-git.md

Combines configuration and installation steps. 'make install-conf' installs Suricata and automatically sets up directories and the 'suricata.yaml' configuration file.

```bash
./configure && make && sudo make install-conf
```

--------------------------------

### Install Suricata and Update Shared Library Cache

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/devguide/codebase/installation-from-git.md

Installs the compiled Suricata binaries and updates the system's shared library cache to recognize the new installation.

```bash
sudo make install
sudo ldconfig
```

--------------------------------

### Install MSYS2 Dependencies

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/install/windows.md

Installs essential development tools and libraries for building Suricata within the MSYS2 UCRT64 environment. Ensure Npcap and WinDivert are installed separately if needed.

```default
pacman -S \
  autoconf \
  automake \
  git \
  make \
  mingw-w64-ucrt-x86_64-cbindgen \
  mingw-w64-ucrt-x86_64-jansson \
  mingw-w64-ucrt-x86_64-libpcap \
  mingw-w64-ucrt-x86_64-libtool \
  mingw-w64-ucrt-x86_64-libyaml \
  mingw-w64-ucrt-x86_64-pcre2 \
  mingw-w64-ucrt-x86_64-rust \
  mingw-w64-ucrt-x86_64-toolchain \
  unzip
```

--------------------------------

### SMB Tree Connect Log Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/output/eve/eve-json-format.md

Example of an SMB 'TREE_CONNECT' command log entry, indicating a share open. It includes details such as transaction ID, dialect, status, session ID, share name, and share type.

```json
"smb": {
  "id": 3,
  "dialect": "2.10",
  "command": "SMB2_COMMAND_TREE_CONNECT",
  "status": "STATUS_SUCCESS",
  "status_code": "0x0",
  "session_id": 4398046511121,
  "tree_id": 1,
  "share": "\\admin-pc\c$",
  "share_type": "FILE"
}
```

--------------------------------

### Install Suricata on Arch Linux using AUR

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/install/other.md

Use the `yay` AUR helper to install the Suricata package from the Arch User Repository. Ensure you have `yay` or another AUR helper installed.

```bash
yay -S suricata
```

--------------------------------

### Install Pre-installation Requirements on Ubuntu

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/devguide/codebase/installation-from-git.md

Ensures all necessary dependencies for building Suricata are installed on Ubuntu systems. This command should be run before proceeding with the Suricata build.

```bash
sudo apt-get -y install libpcre2-dev build-essential autoconf \
automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev \
pkg-config zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 make \
libmagic-dev libjansson-dev rustc cargo jq git-core
```

--------------------------------

### Configure and Build Suricata

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/install/windows.md

Initializes the build environment with autogen.sh and configures Suricata. Specify Npcap include and library paths for live capture support. Omit --with-libpcap options for building without live capture.

```default
./autogen.sh
./configure --prefix=/usr/local \
    --with-libpcap-includes=/c/npcap/Include \
    --with-libpcap-libraries=/c/npcap/Lib/x64
```

--------------------------------

### Fast Log Alert Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/configuration/suricata-yaml.md

An example of a single line alert from the fast.log file.

```default
10/05/10-10:08:59.667372 	[**] [1:2009187:4] ET WEB_CLIENT ACTIVEX iDefense
  COMRaider ActiveX Control Arbitrary File Deletion [**] [Classification: Web
  Application Attack] [Priority: 3] {TCP} xx.xx.232.144:80 -> 192.168.1.4:56068
```

--------------------------------

### Port Negation Example

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/rules/intro.md

This example excludes a specific port from the source or destination matching.

```suricata
!80
```

--------------------------------

### Start Suricata with Napatech

Source: https://github.com/oisf/suricata/blob/main/doc/userguide/capture-hardware/napatech.md

Launches Suricata with Napatech support enabled, using the specified configuration file and running in worker mode.

```bash
$ suricata -c /usr/local/etc/suricata/suricata.yaml --napatech --runmode workers
```