### Install Suricata and jq on Ubuntu

Source: https://docs.suricata.io/en/latest/index.html/quickstart

Installs the latest stable Suricata version and the jq tool on Ubuntu using the official PPA. jq is recommended for processing Suricata's EVE JSON output.

```bash
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt update
sudo apt install suricata jq

```

--------------------------------

### Suricata: Full Auto-setup

Source: https://docs.suricata.io/en/latest/index.html/devguide/codebase/installation-from-git

This command performs a complete Suricata setup, combining configuration file installation and ruleset download. It prepares Suricata to be ready for immediate use with a configured environment and the latest rules.

```bash
./configure && make && make install-full

```

--------------------------------

### Auto-Setup Suricata Configuration and Rules

Source: https://docs.suricata.io/en/latest/index.html/install

Automates the setup of Suricata after compilation. `make install-conf` installs the binary and sets up default configuration files and directories. `make install-rules` downloads and installs the latest Emerging Threats ruleset. `make install-full` combines both configurations.

```bash
./configure && make && sudo make install-conf

./configure && make && sudo make install-rules

./configure && make && sudo make install-full
```

--------------------------------

### Start Load Balancer with Suricata and Zeek

Source: https://docs.suricata.io/en/latest/index.html/capture-hardware/netmap

Initiates the 'lb' tool to distribute traffic between Suricata and Zeek. This example shows how to start 'lb' to send traffic from 'eth0' to both Suricata and Zeek, each running on 6 threads. 'lb' is bundled with netmap.

```bash
lb -i eth0 -p suricata:6 -p zeek:6
```

--------------------------------

### Suricata Lua Output Script Example

Source: https://docs.suricata.io/en/latest/index.html/_sources/output/lua-output.rst

An example of a Suricata Lua output script demonstrating the four required hook functions: init, setup, log, and deinit. It logs HTTP request details like URI, Host, User-Agent, and flow information to a file.

```lua
local config = require("suricata.config")
local logger = require("suricata.log")

function init (args)
    local needs = {}
    needs["protocol"] = "http"
    return needs
end

function setup (args) 
    filename = config.log_path() .. "/" .. name
    file = assert(io.open(filename, "a"))
    logger.info("HTTP Log Filename " .. filename)
    http = 0
end

function log(args)
    http_uri = HttpGetRequestUriRaw()
    if http_uri == nil then
        http_uri = "<unknown>"
    end
    http_uri = string.gsub(http_uri, "%c", ".")

    http_host = HttpGetRequestHost()
    if http_host == nil then
        http_host = "<hostname unknown>"
    end
    http_host = string.gsub(http_host, "%c", ".")

    http_ua = HttpGetRequestHeader("User-Agent")
    if http_ua == nil then
        http_ua = "<useragent unknown>"
    end
    http_ua = string.gsub(http_ua, "%g", ".")

    timestring = SCPacketTimeString()
    ip_version, src_ip, dst_ip, protocol, src_port, dst_port = SCFlowTuple()

    file:write (timestring .. " " .. http_host .. " [**] " .. http_uri .. " [**] " ..
           http_ua .. " [**] " .. src_ip .. ":" .. src_port .. " -> " ..
           dst_ip .. ":" .. dst_port .. "\n")
    file:flush()

    http = http + 1
end

function deinit (args) 
    logger.info ("HTTP transactions logged: " .. http)
    file:close(file)
end
```

--------------------------------

### Check Suricata Build Info and Service Status

Source: https://docs.suricata.io/en/latest/index.html/quickstart

Verifies the installed Suricata version, build options, and checks the status of the Suricata service. This is a crucial step after installation to ensure Suricata is running correctly.

```bash
sudo suricata --build-info
sudo systemctl status suricata

```

--------------------------------

### Suricata: Auto-setup Configuration

Source: https://docs.suricata.io/en/latest/index.html/devguide/codebase/installation-from-git

This command configures, builds, and installs Suricata with default configuration files and directories. It automates the creation of necessary directories and the `suricata.yaml` file.

```bash
./configure && make && sudo make install-conf

```

--------------------------------

### Compile and Install Suricata

Source: https://docs.suricata.io/en/latest/index.html/install

Compiles Suricata from source and installs it on the system. The `./configure` step prepares the build, `make -j8` compiles the code with 8 parallel jobs, and `make install` places the binary in the system's PATH. `make install-full` also installs configuration and rulesets.

```bash
./configure # you may want to add additional parameters here
# ./configure --help to get all available parameters
# j is for adding concurrency to make; the number indicates how much
# concurrency so choose a number that is suitable for your build system
make -j8
make install # to install your Suricata compiled binary
# make install-full - installs configuration and rulesets as well
```

--------------------------------

### Start Napatech Service

Source: https://docs.suricata.io/en/latest/index.html/capture-hardware/napatech

Starts the Napatech service (`ntservice`) to complete the installation on all Linux distributions. This command typically requires root privileges.

```bash
$ /opt/napatech3/bin/ntstart.sh -m
```

--------------------------------

### Install Suricata Dependencies on Ubuntu

Source: https://docs.suricata.io/en/latest/index.html/devguide/codebase/installation-from-git

Installs necessary development libraries and tools for building Suricata on Ubuntu systems. This includes libraries for PCRE, libpcap, libnet, zlib, libcap-ng, libmagic, jansson, and Rust's cargo. It also installs git for source control.

```bash
sudo apt-get -y install libpcre2-dev build-essential autoconf \
automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev \
pkg-config zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 make \
libmagic-dev libjansson-dev rustc cargo jq git-core

```

--------------------------------

### Suricata: Auto-setup Ruleset

Source: https://docs.suricata.io/en/latest/index.html/devguide/codebase/installation-from-git

This command configures, builds, and installs Suricata, then automatically downloads and sets up the latest ruleset from Emerging Threats. This ensures Suricata has up-to-date threat detection rules.

```bash
./configure && make && make install-rules

```

--------------------------------

### Install Minimal Dependencies on Ubuntu/Debian

Source: https://docs.suricata.io/en/latest/index.html/install

Installs the essential packages required for compiling Suricata on Ubuntu and Debian systems. This command uses `apt` to install build tools, development libraries, and Rust components.

```bash
sudo apt -y install autoconf automake build-essential cargo \
    cbindgen libjansson-dev libpcap-dev libpcre2-dev libtool \
    libyaml-dev make pkg-config rustc zlib1g-dev
```

--------------------------------

### Configure Suricata Network Interface and HOME_NET

Source: https://docs.suricata.io/en/latest/index.html/quickstart

Demonstrates how to configure Suricata's network interface and HOME_NET variable. This involves editing the suricata.yaml file to specify the network interface (e.g., enp1s0) and relevant IP ranges for monitoring.

```yaml
af-packet:
    - interface: enp1s0
      cluster-id: 99
      cluster-type: cluster_flow
      defrag: yes
      tpacket-v3: yes

```

--------------------------------

### Clone and Build Suricata from Source

Source: https://docs.suricata.io/en/latest/index.html/devguide/codebase/installation-from-git

Clones the Suricata repository from GitHub, bundles necessary scripts, configures the build environment, compiles the source code, and installs Suricata on the system. It also updates the dynamic linker cache.

```bash
mkdir suricata  # mkdir oisf
cd suricata  # cd oisf
git clone https://github.com/OISF/suricata.git
cd suricata
./scripts/bundle.sh
./autogen.sh
./configure
make
sudo make install
sudo ldconfig

```

--------------------------------

### Install Rust and cbindgen for Suricata

Source: https://docs.suricata.io/en/latest/index.html/install

Provides instructions for installing Rust and `cbindgen` if they are not available or outdated in the system's package manager. It includes steps to install Rust directly from the official website and `cbindgen` using Cargo, ensuring the Cargo bin directory is added to the PATH.

```bash
1) Install Rust https://www.rust-lang.org/en-US/install.html
2) Install cbindgen - if the cbindgen is not found in the repository
   or the cbindgen version is lower than required, it can be
   alternatively installed as: cargo install --force cbindgen
3) Make sure the cargo path is within your PATH environment
   echo 'export PATH="~/.cargo/bin:${PATH}"' >> ~/.bashrc
   export PATH="~/.cargo/bin:${PATH}"
```

--------------------------------

### Install Minimal Dependencies on RPM-based Distributions

Source: https://docs.suricata.io/en/latest/index.html/install

Installs the essential packages for compiling Suricata on RPM-based systems. This command uses `dnf` to install Rust components and development libraries.

```bash
sudo dnf install -y rustc cargo cbindgen
sudo dnf install -y gcc gcc-c++ jansson-devel libpcap-devel \
    libyaml-devel make pcre2-devel zlib-devel
```

--------------------------------

### Suricata Lua Output Script Structure and HTTP Logging Example

Source: https://docs.suricata.io/en/latest/index.html/output/lua-output

This Lua script demonstrates the structure required for Suricata output plugins. It defines the init, setup, log, and deinit functions to register for HTTP protocol events, set up a log file, log HTTP request details (URI, Host, User-Agent, IP addresses, ports), and provide a summary count upon deinitialization.

```lua
local config = require("suricata.config")
local logger = require("suricata.log")

function init (args)
    local needs = {}
    needs["protocol"] = "http"
    return needs
end

function setup (args) 
    filename = config.log_path() .. "/" .. name
    file = assert(io.open(filename, "a"))
    logger.info("HTTP Log Filename " .. filename)
    http = 0
end

function log(args)
    http_uri = HttpGetRequestUriRaw()
    if http_uri == nil then
        http_uri = "<unknown>"
    end
    http_uri = string.gsub(http_uri, "%c", ".")

    http_host = HttpGetRequestHost()
    if http_host == nil then
        http_host = "<hostname unknown>"
    end
    http_host = string.gsub(http_host, "%c", ".")

    http_ua = HttpGetRequestHeader("User-Agent")
    if http_ua == nil then
        http_ua = "<useragent unknown>"
    end
    http_ua = string.gsub(http_ua, "%g", ".")

    timestring = SCPacketTimeString()
    ip_version, src_ip, dst_ip, protocol, src_port, dst_port = SCFlowTuple()

    file:write (timestring .. " " .. http_host .. " [**] " .. http_uri .. " [**] " ..
           http_ua .. " [**] " .. src_ip .. ":" .. src_port .. " -> " ..
           dst_ip .. ":" .. dst_port .. "\n")
    file:flush()

    http = http + 1
end

function deinit (args) 
    logger.info ("HTTP transactions logged: " .. http);
    file:close(file)
end

```

--------------------------------

### Install Clang Compiler

Source: https://docs.suricata.io/en/latest/index.html/capture-hardware/ebpf-xdp

Installs the Clang compiler, a prerequisite for building eBPF programs used by Suricata. Clang version 3.9 or later is recommended for full compatibility.

```bash
sudo apt install clang
```

--------------------------------

### Install libcap-ng

Source: https://docs.suricata.io/en/latest/index.html/configuration/dropping-privileges

Steps to download, compile, and install the libcap-ng library from source. This library is a prerequisite for Suricata to drop privileges after startup.

```bash
wget http://people.redhat.com/sgrubb/libcap-ng/libcap-ng-0.7.8.tar.gz
tar -xzvf libcap-ng-0.7.8.tar.gz
cd libcap-ng-0.7.8
./configure
make
make install
```

--------------------------------

### Kerberos Fields Example in SMB Protocol

Source: https://docs.suricata.io/en/latest/index.html/output/eve/eve-json-format

Illustrates the Kerberos fields within an SMB protocol structure, specifically for session setup. This includes the Kerberos realm and a list of service names (snames).

```json
{
  "smb": {
    "dialect": "2.10",
    "command": "SMB2_COMMAND_SESSION_SETUP",
    "status": "STATUS_SUCCESS",
    "status_code": "0x0",
    "session_id": 35184439197745,
    "tree_id": 0,
    "kerberos": {
      "realm": "CONTOSO.LOCAL",
      "snames": [
        "cifs",
        "DC1.contoso.local"
      ]
    }
  }
}
```

--------------------------------

### Build and Install libbpf from Source

Source: https://docs.suricata.io/en/latest/index.html/capture-hardware/ebpf-xdp

Clones the libbpf repository, builds the library, and installs it. This is an alternative if the 'libbpf-dev' package is unavailable. It includes steps to update the dynamic linker cache.

```bash
git clone https://github.com/libbpf/libbpf.git
cd libbpf/src/
make && sudo make install

sudo make install_headers
sudo ldconfig
```

--------------------------------

### Define Suricata Alert Signature

Source: https://docs.suricata.io/en/latest/index.html/quickstart

An example of a Suricata alert signature (SID 2100498) designed to test IDS functionality. This signature triggers on specific IP traffic content.

```suricata
alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;)
```

--------------------------------

### Suricata WinDivert Examples (Shell)

Source: https://docs.suricata.io/en/latest/index.html/setting-up-ipsinline-for-windows

Illustrative commands for running Suricata with WinDivert, demonstrating how to capture all traffic, TCP traffic, TCP traffic on a specific port, and combined TCP and ICMP traffic.

```shell
suricata -c suricata.yaml --windivert[-forward] true
```

```shell
suricata -c suricata.yaml --windivert tcp
```

```shell
suricata -c suricata.yaml --windivert "tcp.DstPort == 80"
```

```shell
suricata -c suricata.yaml --windivert "tcp or icmp"
```

--------------------------------

### Example Output: Missing Public Key

Source: https://docs.suricata.io/en/latest/index.html/verifying-source-files

This output indicates that the GPG verification failed because the necessary OISF signing public key is not found in the local GPG keyring. To resolve this, the OISF signing key must be imported.

```text
gpg: Signature made Tue 23 Apr 2024 11:58:56 AM UTC
gpg:                using RSA key B36FDAF2607E10E8FFA89E5E2BA9C98CCDF1E93A
gpg: Can't check signature: No public key
```

--------------------------------

### PostgreSQL Startup Parameters

Source: https://docs.suricata.io/en/latest/index.html/appendix/eve-index

Details the startup parameters for a PostgreSQL connection, including user and optional connection settings.

```APIDOC
## pgsql.request.startup_parameters (object)

### Description
Startup parameters for a PostgreSQL connection.

### Fields
- **optional_parameters** (array of objects) - Optional connection parameters.
- **user** (string) - The username for the connection.
```

--------------------------------

### Suricata Rule Example with Classtype

Source: https://docs.suricata.io/en/latest/index.html/_sources/rules/meta.rst

An example of a Suricata HTTP rule that includes a classtype definition. This rule alerts on specific HTTP GET requests containing 'rule' in the URI and categorizes the event with 'bad-unknown'.

```suricata
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP GET Request Containing Rule in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"rule"; fast_pattern; :example-rule-emphasis:`classtype:bad-unknown;` sid:123; rev:1;)
```

--------------------------------

### Format Suricata Rules with Example Containers

Source: https://docs.suricata.io/en/latest/index.html/devguide/contributing/contribution-process

Demonstrates how to use the 'example-rule' container to format Suricata rules. This container enhances readability and allows for specific element highlighting. It requires invoking a role like 'example-rule-role' once per document.

```rst
.. role:: example-rule-role

.. container:: example-rule

   :example-rule-action:`alert` :example-rule-header:`http $HOME_NET any ->
   $EXTERNAL_NET any` :example-rule-options:`(msg:"HTTP GET Request Containing
   Rule in URI"; flow:established,to_server; http.method; content:"GET"; http.uri;
   content:"rule"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)`
```

```rst
.. container:: example-rule

alert ssh any any -> any any (msg:"match SSH protocol version";
:example-rule-emphasis:`ssh.proto;` content:"2.0"; sid:1000010;)
```

--------------------------------

### Install Suricata IPS Dependencies on Ubuntu

Source: https://docs.suricata.io/en/latest/index.html/devguide/codebase/installation-from-git

Installs additional libraries required for Suricata to function in Intrusion Prevention System (IPS) mode on Ubuntu. This includes libnetfilter-queue and libnfnetlink development packages.

```bash
sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 \
libnfnetlink-dev libnfnetlink0

```

--------------------------------

### Suricata Packet-Stream Rule Examples

Source: https://docs.suricata.io/en/latest/index.html/rules/rule-types

These Suricata rules are categorized as packet-stream rules because they inspect specific portions of the packet payload using the 'content' keyword with 'startswith' or 'depth'. The examples demonstrate anchoring content at the start of the payload or within a specific depth.

```suricata
alert tcp any any -> any any (msg:"tcp, anchored content"; content:"abc"; startswith; sid:303;)
```

```suricata
alert http any any -> any any (msg:"http, anchored content"; content:"abc"; depth:30; sid:603;)
```

--------------------------------

### Get Server Certificate Validity Start Timestamp (Lua)

Source: https://docs.suricata.io/en/latest/index.html/lua/libs/tls

Retrieves the Unix timestamp indicating the start date of the server's TLS certificate validity. Scripts can use this to verify if a certificate is active by comparing the timestamp against the current time.

```lua
function log (args)
    notbefore = t:get_server_cert_not_before()
    if notbefore > os.time() then
        -- not yet valid certificate
    end
end

```

--------------------------------

### Suricata Rule Example: Decoding and Matching Base64 Data

Source: https://docs.suricata.io/en/latest/index.html/rules/base64-keywords

An example Suricata rule demonstrating the use of `base64_decode` and `base64_data` keywords. This rule matches a base64 encoded string 'test' within the http_uri buffer, starting the decoding process relative to a preceding string 'somestring' with a specified offset.

```suricata
alert http any any -> any any (msg:"Example"; http.uri; content:"somestring"; \
     base64_decode:bytes 8, offset 1, relative; \
     base64_data; content:"test"; sid:10001; rev:1;)
```

--------------------------------

### Get Client Certificate Validity Start Timestamp (Lua)

Source: https://docs.suricata.io/en/latest/index.html/lua/libs/tls

Retrieves the Unix timestamp indicating the start date of the client's TLS certificate validity. Scripts can use this to determine if a certificate is not yet valid by comparing the timestamp with the current time.

```lua
function log (args)
    notbefore = t:get_client_cert_not_before()
    if notbefore > os.time() then
        -- not yet valid certificate
    end
end

```

--------------------------------

### Install and Verify ethtool

Source: https://docs.suricata.io/en/latest/index.html/performance/high-performance-config

This snippet demonstrates how to download, compile, install, and verify the version of the ethtool utility. ethtool is crucial for configuring NIC settings.

```bash
wget https://mirrors.edge.kernel.org/pub/software/network/ethtool/ethtool-5.2.tar.xz
tar -xf ethtool-5.2.tar.xz
cd ethtool-5.2
./configure && make clean && make && make install
/usr/local/sbin/ethtool --version
```

--------------------------------

### Restart Suricata Service

Source: https://docs.suricata.io/en/latest/index.html/quickstart

Restarts the Suricata service to apply updated configurations or rules. This command ensures Suricata is running with the latest settings.

```bash
sudo systemctl restart suricata
```

--------------------------------

### PostgreSQL Optional Startup Parameters

Source: https://docs.suricata.io/en/latest/index.html/appendix/eve-index

Specifies optional parameters that can be included during PostgreSQL connection startup.

```APIDOC
## pgsql.request.startup_parameters.optional_parameters (array of objects)

### Description
Optional parameters for PostgreSQL connection startup.

### Fields
- **application_name** (string) - Application name.
- **client_encoding** (string) - Client encoding.
- **database** (string) - Database name.
- **datestyle** (string) - Date style.
- **extra_float_digits** (string) - Extra float digits setting.
- **options** (string) - Connection options.
- **replication** (string) - Replication setting.
```

--------------------------------

### Configure Rust and Install cbindgen

Source: https://docs.suricata.io/en/latest/index.html/devguide/codebase/installation-from-git

Sets the PATH environment variable to include the Cargo bin directory and then installs the cbindgen tool using cargo. This tool is used for generating C bindings for Rust code, which might be necessary for Suricata's integration.

```bash
export PATH=$PATH:${HOME}/.cargo/bin
cargo install --force cbindgen

```

--------------------------------

### QUIC Logging Example with Fingerprints

Source: https://docs.suricata.io/en/latest/index.html/output/eve/eve-json-format

An example of QUIC logging showcasing version, CYU, JA3, and JA4 fingerprints. The JA4 hash is illustrative.

```json
"quic": {
  "version": 1362113590,
  "cyu": [
      {
          "hash": "7b3ceb1adc974ad360cfa634e8d0a730",
          "string": "46,PAD-SNI-STK-SNO-VER-CCS-NONC-AEAD-UAID-SCID-TCID-PDMD-SMHL-ICSL-NONP-PUBS-MIDS-SCLS-KEXS-XLCT-CSCT-COPT-CCRT-IRTT-CFCW-SFCW"
      }
  ],
  "ja3": {
      "hash": "324f8c50e267adba4b5dd06c964faf67",
      "string": "771,4865-4866-4867,51-43-13-27-17513-16-45-0-10-57,29-23-24,"
  },
  "ja4": "q13d0310h3_55b375c5d22e_cd85d2d88918"
}
```

--------------------------------

### Check Suricata Log

Source: https://docs.suricata.io/en/latest/index.html/quickstart

Displays the last lines of the Suricata log file to verify the service is running and initialized. The output indicates the number of packet and management threads initialized.

```bash
sudo tail /var/log/suricata/suricata.log
```

--------------------------------

### Monitor Suricata Statistics

Source: https://docs.suricata.io/en/latest/index.html/quickstart

Continuously monitors the Suricata statistics log file for real-time updates on packet processing and traffic decoding. The log is typically updated every 8 seconds.

```bash
sudo tail -f /var/log/suricata/stats.log
```

--------------------------------

### Example Match Function for HTTP Request (Lua)

Source: https://docs.suricata.io/en/latest/index.html/lua/libs/packetlib

An example Suricata Lua match function that inspects packet payloads line by line to find an HTTP GET request for '/index.html'. If found, it logs a notice with packet details including timestamps, IPs, ports, and pcap count. This demonstrates practical application of packet accessor functions.

--------------------------------

### Initial Network Interface Configuration

Source: https://docs.suricata.io/en/latest/index.html/capture-hardware/af-xdp

Brings down a network interface (eth3) before applying configuration changes. This is a common step in network setup procedures.

```bash
ifconfig eth3 down

```

--------------------------------

### Get File ID using Suricata Lua Library

Source: https://docs.suricata.io/en/latest/index.html/lua/libs/file

This Lua example shows how to obtain the unique ID of a file using the Suricata file library's 'file_id' method.

```lua
local file = filelib.get_file()
local id = file:file_id()
print("File ID: " .. id)
```

--------------------------------

### Parse Suricata EVE JSON Alerts with jq

Source: https://docs.suricata.io/en/latest/index.html/quickstart

Uses `jq` to filter and display only the alert events from the Suricata EVE JSON log file. This provides detailed information about each triggered alert.

```bash
sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'
```

--------------------------------

### Mounting the bpf Pseudo Filesystem

Source: https://docs.suricata.io/en/latest/index.html/_sources/capture-hardware/ebpf-xdp.rst

Instructions for mounting the 'bpf' pseudo filesystem, which is necessary for using pinned maps. This can be done temporarily or persistently via fstab.

```bash
sudo mount -t bpf none /sys/fs/bpf
```

```bash
bpffs /sys/fs/bpf bpf defaults 0 0
```

```bash
sudo mount -a
```

--------------------------------

### Example Output: Good Signature (Trusted Key)

Source: https://docs.suricata.io/en/latest/index.html/verifying-source-files

This output signifies a successful verification of the Suricata distribution file. It confirms that the signature is valid and that the Open Information Security Foundation (OISF) signing key is present and trusted in the local GPG keyring.

```text
gpg: Signature made Tue 23 Apr 2024 11:58:56 AM UTC
gpg:                using RSA key B36FDAF2607E10E8FFA89E5E2BA9C98CCDF1E93A
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2025-08-06
gpg: Good signature from "Open Information Security Foundation (OISF)"
<releases@openinfosecfoundation.org> [ultimate]
```

--------------------------------

### Get DNS Queries as Table

Source: https://docs.suricata.io/en/latest/index.html/lua/libs/dns

Retrieves the DNS queries section (request or response) as a table of tables. The example iterates through queries, extracting rrname and rrtype, and includes a placeholder for other details.

```lua
local tx = dns.get_tx()
local queries = tx:queries();
if queries ~= nil then
    for n, t in pairs(queries) do
        rrname = t["rrname"]
        rrtype = t["type"]

        print ("QUERY: " .. ts .. " " .. rrname .. " [**] " .. rrtype .. " [**] " ..
               "TODO" .. " [**] " .. srcip .. ":" .. sp .. " -> " ..
               dstip .. ":" .. dp)
    end
end
```

--------------------------------

### Parse Suricata EVE JSON Statistics with jq

Source: https://docs.suricata.io/en/latest/index.html/quickstart

Uses `jq` to filter and display specific statistics, such as kernel packets captured, from the Suricata EVE JSON log file. It can also display all statistics.

```bash
sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="stats")|.stats.capture.kernel_packets'
sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="stats")'
```

--------------------------------

### DNS Query Sticky Buffer Classic Example Rule

Source: https://docs.suricata.io/en/latest/index.html/rules/multi-buffer-matching

This Suricata rule illustrates the classic behavior of sticky buffers, where multiple content matches apply to a single 'dns.query' buffer. It alerts on a DNS query containing 'example.net' or 'example.domain.net', demonstrating how content matches are aggregated within one buffer instance.

```suricata
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"DNS Query Sticky Buffer Classic Example Rule"; dns.query; content:"example"; content:".net"; classtype:misc-activity; sid:1; rev:1;)
```

--------------------------------

### Trigger and Monitor Suricata Alert

Source: https://docs.suricata.io/en/latest/index.html/quickstart

Tests the Suricata IDS by triggering a specific alert signature and monitoring the `fast.log` file for the alert output. A `curl` command is used to generate traffic that matches the signature.

```bash
sudo tail -f /var/log/suricata/fast.log
curl http://testmynids.org/uid/index.html
```

--------------------------------

### Start Load Balancer on FreeBSD 11

Source: https://docs.suricata.io/en/latest/index.html/capture-hardware/netmap

Starts the 'lb' tool on FreeBSD 11, which does not support named pipes. This command directs traffic from 'eth0' to 6 threads. Note the absence of the named prefix for the port specification.

```bash
lb -i eth0 -p 6
```

--------------------------------

### Get Flow Timestamps in Lua

Source: https://docs.suricata.io/en/latest/index.html/lua/libs/flowlib

This Lua code retrieves the timestamps of the first and last packets within a Suricata flow. It returns the start and last timestamps as seconds and microseconds since the Unix epoch.

```lua
f = flow.get()
local start_sec, start_usec, last_sec, last_usec = f:timestamps()
```

--------------------------------

### Get File Name using Suricata Lua Library

Source: https://docs.suricata.io/en/latest/index.html/lua/libs/file

This Lua example retrieves the name of a file using the 'name' method provided by the Suricata file library. It includes a check for nil values.

```lua
local file = filelib.get_file()
local name = file:name()
if name ~= nil then
    print("Filename: " .. name)
end
```

--------------------------------

### Execute Suricata Commands via suricatasc Client

Source: https://docs.suricata.io/en/latest/index.html/unix-socket

Demonstrates how to interact with Suricata in standard running mode using the `suricatasc` command-line client. This includes listing interfaces, retrieving interface statistics, and getting configuration values. Commands can be executed interactively or directly.

```bash
# suricatasc
>>> iface-list
Success: {'count': 2, 'ifaces': ['eth0', 'eth1']}
>>> iface-stat eth0
Success: {'pkts': 378, 'drop': 0, 'invalid-checksums': 0}
>>> conf-get unix-command.enabled
Success:
"yes"

```

```bash
# suricatasc -c version
{'message': '5.0.3 RELEASE', 'return': 'OK'}
# suricatasc -c uptime
{'message': 35264, 'return': 'OK'}
# suricatasc -c "iface-stat eth0"
{'message': {'pkts': 5110429, 'drop': 0, 'invalid-checksums': 0}, 'return': 'OK'}

```

--------------------------------

### Include Additional Configuration Files in Suricata

Source: https://docs.suricata.io/en/latest/index.html/manpages/suricata

Demonstrates how to include additional configuration files with Suricata using the '--include' option. This allows for modular configuration management. Multiple files can be included in the order specified.

```bash
--include /etc/suricata/other.yaml
```

```bash
--include /etc/suricata/other.yaml --include /etc/suricata/extra.yaml
```

--------------------------------

### Systemd Unit File Configuration for Notification

Source: https://docs.suricata.io/en/latest/index.html/_sources/configuration/systemd-notify.rst

Example of a systemd service unit file configuration to enable notification. Setting 'Type=notify' instructs systemd to wait for a 'READY=1' signal from the service before considering it started.

```systemd unit file
[Unit]
Description=Suricata Intrusion Detection System
After=network.target

[Service]
Type=notify
ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml
Restart=on-failure

[Install]
WantedBy=multi-user.target
```