Suricata

https://docs.suricata.io/en/latest/
Admin
Suricata is an open-source network threat detection engine that combines intrusion detection (IDS),...
Tokens:843,899
Snippets:6,952
Trust Score:10
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### SMB1 session setup log example

Source: https://docs.suricata.io/en/latest/_sources/output/eve/eve-json-format.rst.txt

Example SMB log entry for a partial SMB1_COMMAND_SESSION_SETUP_ANDX showing request and response native OS and Lan Manager strings.

```json
"request": {
  "native_os": "Unix",
  "native_lm": "Samba 3.9.0-SVN-build-11572"
},
"response": {
  "native_os": "Windows (TM) Code Name \"Longhorn\" Ultimate 5231",
  "native_lm": "Windows (TM) Code Name \"Longhorn\" Ultimate 6.0"
}
```

--------------------------------

### smb.ntlmssp_user rule examples

Source: https://docs.suricata.io/en/latest/_sources/rules/smb-keywords.rst.txt

Match on SMB ntlmssp user in session setup. Both examples are sticky buffers and can be used as fast_pattern.

```suricata
smb.ntlmssp_user; content:"doe"; endswith;

```

```suricata
smb.ntlmssp_user; content:"doe"; nocase; pcre:"/j(ohn|ane).*doe$/";

```

--------------------------------

### smb.ntlmssp_domain rule examples

Source: https://docs.suricata.io/en/latest/_sources/rules/smb-keywords.rst.txt

Match on SMB ntlmssp domain in session setup. Both examples are sticky buffers and can be used as fast_pattern.

```suricata
smb.ntlmssp_domain; content:"home"; endswith;

```

```suricata
smb.ntlmssp_domain; content:"home"; nocase; pcre:"/home(sweet)*$/";

```

--------------------------------

### Suricata startup notice

Source: https://docs.suricata.io/en/latest/_sources/quickstart.rst.txt

Example log line indicating Suricata started successfully. The actual thread count depends on the system and configuration.

```text
<Notice> - all 4 packet processing threads, 4 management threads initialized, engine started.
```

--------------------------------

### Rule example with highlighted action, header, and options

Source: https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html

Example of a rule with highlighted action, header, and options using the example-rule container. Renders as: alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP GET Request Containing Rule in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"rule"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)

```reStructuredText
.. container:: example-rule

:example-rule-action:`alert` :example-rule-header:`http $HOME_NET any ->
$EXTERNAL_NET any` :example-rule-options:`(msg:"HTTP GET Request Containing
Rule in URI"; flow:established,to_server; http.method; content:"GET"; http.uri;
content:"rule"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)`

```

--------------------------------

### Lua output script example with four hook functions

Source: https://docs.suricata.io/en/latest/_sources/output/lua-output.rst.txt

Defines init(), setup(), log(), and deinit() to log HTTP transaction details (URI, host, user-agent, timestamps, and tuple) to a file. Uses suricata.config, suricata.log, suricata.http, suricata.packet, and suricata.flow modules. The setup() function opens a file in append mode and logs the filename; log() writes a line per HTTP transaction; deinit() logs the count and closes the file.

```lua
local config = require("suricata.config")
local logger = require("suricata.log")
local http = require("suricata.http")
local packet = require("suricata.packet")
local flow = require("suricata.flow")

function init (args)
    local needs = {}
    needs["protocol"] = "http"
    return needs
end

function setup (args)
    filename = config.log_path() .. "/" .. name
    file = assert(io.open(filename, "a"))
    logger.info("HTTP Log Filename " .. filename)
    http = 0
end

function log(args)
    local tx = http.get_tx()

    http_uri = tx:request_uri_raw()
    if http_uri == nil then
        http_uri = "<unknown>"
    end
    http_uri = string.gsub(http_uri, "%c", ".")

    http_host = tx:request_host()
    if http_host == nil then
        http_host = "<hostname unknown>"
    end
    http_host = string.gsub(http_host, "%c", ".")

    http_ua = tx:request_header("User-Agent")
    if http_ua == nil then
        http_ua = "<useragent unknown>"
    end
    http_ua = string.gsub(http_ua, "%g", ".")

    local p = packet.get()
    timestring = p:timestring_legacy()
    ip_version, src_ip, dst_ip, protocol, src_port, dst_port = p:tuple()

    file:write (timestring .. " " .. http_host .. " [**] " .. http_uri .. " [**] " ..
           http_ua .. " [**] " .. src_ip .. ":" .. src_port .. " -> " ..
           dst_ip .. ":" .. dst_port .. "\n")
    file:flush()

    http = http + 1
end

function deinit (args)
    logger.info ("HTTP transactions logged: " .. http);
    file:close(file)
end
```

--------------------------------

### ntp.version examples

Source: https://docs.suricata.io/en/latest/_sources/rules/ntp-keywords.rst.txt

Examples of ntp.version with exact and comparison operators.

```suricata
ntp.version:4    # exactly 4
ntp.version:<4   # smaller than 4
ntp.version:>=3  # greater or equal than 3
```

--------------------------------

### HTTP detection Lua script example

Source: https://docs.suricata.io/en/latest/_sources/lua/lua-functions.rst.txt

Example Lua script for HTTP detection using rule hooks. It checks if the HTTP request line starts with GET and returns 1 if so, otherwise 0.

```lua
local http = require("suricata.http")

function init (args)
  return {}
end

function match(args)
  local tx, err = http.get_tx()
  http_request_line, err = tx:request_line()

  if #http_request_line > 0 then
      --GET /base64-hello-world.txt HTTP/1.1
      if http_request_line:find("^GET") then
          return 1
      end
  end

  return 0
end
```

--------------------------------

### Auto-setup Suricata with install-full

Source: https://docs.suricata.io/en/latest/_sources/devguide/codebase/installation-from-git.rst.txt

Runs configure, make, and then install-full. This combines install-conf and install-rules, presenting a ready-to-run (configured and set-up) Suricata.

```bash
./configure && make && make install-full
```

--------------------------------

### Start Napatech service with ntstart.sh

Source: https://docs.suricata.io/en/latest/capture-hardware/napatech.html

Start the Napatech service (ntservice) after installation. This command is required for all distributions to complete the installation.

```bash
$ /opt/napatech3/bin/ntstart.sh -m

```

--------------------------------

### Build and install Suricata from source

Source: https://docs.suricata.io/en/latest/_sources/install.rst.txt

Basic steps to build and install Suricata from the source distribution. This installs Suricata into /usr/local/bin/, uses the default configuration in /usr/local/etc/suricata/, and outputs to /usr/local/var/log/suricata.

```bash
tar xzvf suricata-8.0.3.tar.gz
cd suricata-8.0.3
./configure
make
make install
```

--------------------------------

### Get HTTP request line

Source: https://docs.suricata.io/en/latest/_sources/lua/libs/http.rst.txt

Gets the HTTP request line and prints it if it starts with GET.

```lua
local tx = http.get_tx()
local http_request_line = tx:request_line();
if #http_request_line > 0 then
    if http_request_line:find("^GET") then
        print(http_request_line)
    end
end
```

--------------------------------

### Start Napatech ntservice

Source: https://docs.suricata.io/en/latest/_sources/capture-hardware/napatech.rst.txt

Complete the Napatech installation by starting the ntservice with the -m flag. This is required for all distributions.

```bash
$ /opt/napatech3/bin/ntstart.sh -m
```

--------------------------------

### Auto-setup Suricata with install-conf

Source: https://docs.suricata.io/en/latest/_sources/devguide/codebase/installation-from-git.rst.txt

Runs configure, make, and then install-conf. The install-conf target does the regular 'make install' and automatically creates/sets up all necessary directories and suricata.yaml.

```bash
./configure && make && sudo make install-conf
```

--------------------------------

### Setup file logging with init function

Source: https://docs.suricata.io/en/latest/lua/libs/file.html

Sets up a logging script that requires file data events.

```lua
function init (args)
   local needs = {}
   needs["type"] = "file"
   return needs
end

```

--------------------------------

### Build and install libbpf from source

Source: https://docs.suricata.io/en/latest/capture-hardware/ebpf-xdp.html

Build and install libbpf from the cloned source, including headers and ldconfig.

```bash
cd libbpf/src/
make && sudo make install

sudo make install_headers
sudo ldconfig

```

--------------------------------

### http.method keyword example

Source: https://docs.suricata.io/en/latest/_sources/rules/http-keywords.rst.txt

Example HTTP request and corresponding Suricata rule using the http.method keyword to match the GET method.

```http
GET /index.html HTTP/1.1
User-Agent: Mozilla/5.0
Host: suricata.io
```

```suricata
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP Request Example"; \
flow:established,to_server; :example-rule-options:`http.method; \
content:"GET";` classtype:bad-unknown; sid:2; rev:1;)
```

--------------------------------

### Auto-setup Suricata with install-rules

Source: https://docs.suricata.io/en/latest/_sources/devguide/codebase/installation-from-git.rst.txt

Runs configure, make, and then install-rules. The install-rules target does the regular 'make install' and automatically downloads and sets up the latest ruleset from Emerging Threats.

```bash
./configure && make && make install-rules
```

--------------------------------

### SNMP trap type rule example

Source: https://docs.suricata.io/en/latest/_sources/rules/snmp-keywords.rst.txt

Example rule that alerts on SNMP trap cold start, using snmp.pdu_type and snmp.trap_type.

```suricata
alert snmp any any -> any 162 (msg:"SNMP trap cold start"; snmp.pdu_type:trap_v1; snmp.trap_type:coldstart; sid:3; rev:1;)
```

--------------------------------

### Compile and install Suricata with make

Source: https://docs.suricata.io/en/latest/_sources/install.rst.txt

Compile and install Suricata from the source directory. Use ./configure --help to see all available parameters; the -j flag adds concurrency to make, and make install-full also installs configuration and rulesets.

```bash
./configure # you may want to add additional parameters here
# ./configure --help to get all available parameters
# j is for adding concurrency to make; the number indicates how much 
# concurrency so choose a number that is suitable for your build system
make -j8 
make install # to install your Suricata compiled binary
# make install-full - installs configuration and rulesets as well
```

--------------------------------

### Install and load nDPI plugin

Source: https://docs.suricata.io/en/latest/plugins/ndpi.html

Build Suricata with nDPI support and load the nDPI plugin in suricata.yaml. The configure command requires the path to the nDPI source. The plugin path should be present in the default configuration after building.

```bash
./configure --enable-ndpi --with-ndpi=/home/user/src/nDPI
```

```yaml
plugins:
  - /usr/lib/suricata/ndpi.so
```

--------------------------------

### snmp.trap_type syntax and signature example

Source: https://docs.suricata.io/en/latest/rules/snmp-keywords.html

Syntax and signature example for the snmp.trap_type keyword. The value can be specified as an integer or a string (e.g., 0 for coldstart, 1 for warmstart). The example rule matches a cold start trap.

```text
snmp.trap_type:(mode) <number or string>

```

```text
alert snmp any any -> any 162 (msg:"SNMP trap cold start"; snmp.pdu_type:trap_v1; snmp.trap_type:coldstart; sid:3; rev:1;)

```

--------------------------------

### igmp.hdr rule example

Source: https://docs.suricata.io/en/latest/_sources/rules/header-keywords.rst.txt

Example rule using the igmp.hdr sticky buffer to match on the whole IGMP header, with a content match on the byte 0x22 at the start.

```suricata
alert igmp any any -> any any (igmp.hdr; content:"|22|"; startswith; sid:1234; rev:5;)
```

--------------------------------

### http.start rules with example HTTP request and response

Source: https://docs.suricata.io/en/latest/rules/http-keywords.html

Example HTTP request and response, plus two Suricata rules using http.start. The request rule uses flow:to_server and the response rule uses flow:to_client. http.start contains normalized headers and is terminated by an extra \r\n.

```http
GET / HTTP/1.1
Host: suricata.io
Connection: Keep-Alive


```

```http
HTTP/1.1 200 OK
Content-Type: text/html
Server: nginx/0.8.54


```

```suricata
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP Start Request Example"; flow:established,to_server; http.start; content:"POST / HTTP/1.1|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; classtype:bad-unknown; sid:101; rev:1;)
```

```suricata
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP Start Response Example"; flow:established,to_client; http.start; content:"HTTP/1.1 200 OK|0d 0a|Content-Type|0d 0a|Server|0d 0a 0d 0a|"; classtype:bad-unknown; sid:102; rev:1;)
```

--------------------------------

### Basic source installation steps for Suricata 8.0.3

Source: https://docs.suricata.io/en/latest/install.html

Commands to extract, configure, compile, and install Suricata from the source distribution. Installs to /usr/local/bin, uses default config in /usr/local/etc/suricata, and logs to /usr/local/var/log/suricata.

```bash
tar xzvf suricata-8.0.3.tar.gz
cd suricata-8.0.3
./configure
make
make install

```

--------------------------------

### Netflow event example

Source: https://docs.suricata.io/en/latest/output/eve/eve-json-format.html

Example of the netflow event object with fields for packet count, byte count, start and end timestamps, flow age, and minimum and maximum TTL values.

```json
"netflow": {
   "pkts": 1,
   "bytes": 160,
   "start": "2013-02-26T17:02:42.907340-0500",
   "end": "2013-02-26T17:02:42.907340-0500",
   "age": 0,
   "min_ttl": 1,
   "max_ttl": 1
 }
```

--------------------------------

### Enable Suricata on-boot with systemd

Source: https://docs.suricata.io/en/latest/_sources/install/rpm.rst.txt

Configures Suricata to start automatically at boot. Requires sudo.

```none
sudo systemctl enable suricata
```

--------------------------------

### Disable irqbalance

Source: https://docs.suricata.io/en/latest/_sources/capture-hardware/ebpf-xdp.rst.txt

Commands to stop and disable irqbalance, which may cause issues in setups described in the guide.

```bash
systemctl stop irqbalance
systemctl disable irqbalance
```

--------------------------------

### Install libcap-ng from source

Source: https://docs.suricata.io/en/latest/_sources/configuration/dropping-privileges.rst.txt

Download, configure, compile, and install libcap-ng from upstream. This is required for dropping privileges on Suricata after startup.

```bash
wget http://people.redhat.com/sgrubb/libcap-ng/libcap-ng-0.7.8.tar.gz
  tar -xzvf libcap-ng-0.7.8.tar.gz
  cd libcap-ng-0.7.8
  ./configure
  make
  make install
```

--------------------------------

### Complete flow variable usage example

Source: https://docs.suricata.io/en/latest/lua/libs/flowvar.html

Complete example showing how to use flow variables in a Lua script: register, get handle, and update the value in the match function. Note the typo 'fi' instead of 'end' in the source.

```lua
local flowvarlib = require("suricata.flowvar")

function init ()
    flowvarlib.register("count")
    return {}
end

function thread_init ()
    count_var = flowvarlib.get("count")
end

function match ()
    local value = count_var:value()
    if value == nil then
        -- Initialize value to 1.
        value = tostring(1)
        count_var:set(value, #value)
    else
        value = tostring(tonumber(value) + 1)
        count_var:set(value, #value)
    fi

    -- Return 1 or 0 based on your own logic.
    return 1
end

```

--------------------------------

### Start Suricata with systemd

Source: https://docs.suricata.io/en/latest/_sources/install/rpm.rst.txt

Starts the Suricata service. Requires sudo.

```none
sudo systemctl start suricata
```

--------------------------------

### File-store v1 configuration example

Source: https://docs.suricata.io/en/latest/file-extraction/config-update.html

Example of a Suricata file-store v1 configuration. This is the starting point for the migration to v2. It includes options like enabled, log-dir, force-magic, force-hash, force-filestore, stream-depth, waldo, max-open-files, write-meta, and include-pid.

```yaml
- file-store:
    enabled: yes        # set to yes to enable
    log-dir: files      # directory to store the files
    force-magic: no     # force logging magic on all stored files
    force-hash: [md5]   # force logging of md5 checksums
    force-filestore: no # force storing of all files
    stream-depth: 1mb   # reassemble 1mb into a stream, set to no to disable
    waldo: file.waldo   # waldo file to store the file_id across runs
    max-open-files: 0   # how many files to keep open (O means none)
    write-meta: yes     # write a .meta file if set to yes
    include-pid: yes    # include the pid in filenames if set to yes.

```

--------------------------------

### Install Suricata on Enterprise Linux and Rebuilds

Source: https://docs.suricata.io/en/latest/_sources/install/rpm.rst.txt

Commands to enable EPEL and the OISF COPR repository, then install Suricata. Requires sudo.

```none
sudo dnf install epel-release dnf-plugins-core
sudo dnf copr enable @oisf/suricata-8.0
sudo dnf install suricata
```

--------------------------------

### smtp.command_line frame rule

Source: https://docs.suricata.io/en/latest/_sources/rules/smtp-keywords.rst.txt

Example rule using the smtp.command_line frame to match a client command line starting with 'MAIL FROM:'.

```suricata
alert smtp any any -> any any ( \
  frame:smtp.command_line; content:"MAIL|20|FROM:"; startswith; \
  sid:1;)
```

--------------------------------

### sip.method syntax and example

Source: https://docs.suricata.io/en/latest/_sources/rules/sip-keywords.rst.txt

Matches the method in a SIP request. Syntax: sip.method; content:<method>;. Example matches the INVITE method.

```suricata
sip.method; content:<method>;
```

```suricata
sip.method; content:"INVITE";
```

--------------------------------

### Example match function inspecting payload for HTTP request

Source: https://docs.suricata.io/en/latest/_sources/lua/libs/packetlib.rst.txt

Example match function that inspects the payload line by line, checks for the HTTP request line 'GET /index.html HTTP/1.0', and issues a notice log with packet details if found.

```lua
local logger = require("suricata.log")

function match (args)
    p = packet.get()
    payload = p:payload()
    ts = p:timestring()

    for line in payload:gmatch("([^\r\n]*)[\r\n]+") do
        if line == "GET /index.html HTTP/1.0" then
            ipver, srcip, dstip, proto, sp, dp = p:tuple()
            logger.notice(string.format("%s %s->%s %d->%d (pcap_cnt:%d) match! %s", ts, srcip, dstip, sp, dp, p:pcap_cnt(), line));
            return 1
        end
    end

    return 0
end
```

--------------------------------

### startswith usage example

Source: https://docs.suricata.io/en/latest/rules/payload-keywords.html

Modifies the content to match exactly at the start of a buffer. Must follow a content keyword and takes no arguments.

```suricata
content:"GET|20|"; startswith;
```

--------------------------------

### Alert rule with tcp.session

Source: https://docs.suricata.io/en/latest/_sources/rules/flow-keywords.rst.txt

Example rule using tcp.session in an alert rule. The rule matches packets in the setup or established phases.

```suricata
alert tcp any any -> any any (tcp.session:setup,established; sid:1;)
```

--------------------------------

### Set up Cargo and install cbindgen

Source: https://docs.suricata.io/en/latest/_sources/devguide/codebase/installation-from-git.rst.txt

Adds the Cargo bin directory to PATH and installs cbindgen, which is needed for the build. This may take a while depending on your system.

```bash
export PATH=$PATH:${HOME}/.cargo/bin
cargo install --force cbindgen
```

--------------------------------

### ike.init_spi and ike.resp_spi example

Source: https://docs.suricata.io/en/latest/_sources/rules/ike-keywords.rst.txt

Match on exact SPI values for Initiator or Responder. Both are sticky buffers and can be used as fast_pattern.

```suricata
  ike.init_spi; content:"18fe9b731f9f8034";
  ike.resp_spi; content:"a00b8ef0902bb8ec";
```

--------------------------------

### smtp.response_line frame rule

Source: https://docs.suricata.io/en/latest/_sources/rules/smtp-keywords.rst.txt

Example rule using the smtp.response_line frame to match a server response line starting with '354 go ahead'.

```suricata
alert smtp any any -> any any ( \
  frame:smtp.response_line; content:"354 go ahead"; startswith; \
  sid:1;)
```

--------------------------------

### ftp.command and ftp.command_data example

Source: https://docs.suricata.io/en/latest/_sources/rules/ftp-keywords.rst.txt

Example rule matching both ftp.command and ftp.command_data for the USER command.

```suricata
alert ftp any any -> any any (ftp.command; content: "USER"; ftp.command_data; content:"anonymous"; sid: 1;)
```

--------------------------------

### startswith keyword example and shorthand

Source: https://docs.suricata.io/en/latest/_sources/rules/payload-keywords.rst.txt

Shows the startswith keyword and its equivalent shorthand using depth and offset.

```suricata
content:"GET|20|"; startswith;
```

```suricata
content:"GET|20|"; depth:4; offset:0;
```

--------------------------------

### subslice example: offset 10, negative nbytes

Source: https://docs.suricata.io/en/latest/_sources/rules/transforms.rst.txt

Starts at offset 10 and ends 5 bytes from the end, creating a subslice from offset 10 to 12, resulting in 'r'.

```text
subslice: 10, -5;
```

--------------------------------

### Configure Suricata with Netmap includes

Source: https://docs.suricata.io/en/latest/_sources/capture-hardware/netmap.rst.txt

Example configure command for building Suricata with Netmap support, specifying the include path for Netmap headers when not in a standard location.

```bash
./configure --enable-netmap --with-netmap-includes=/usr/local/include/netmap/
```
Tokens:
Raw