WEBVTT 00:00:08.340 --> 00:00:09.210 In this section, 00:00:09.220 --> 00:00:11.550 we're going to take a look at essential commands needed to 00:00:11.550 --> 00:00:13.260 get you up and running with Suricata. 00:00:13.640 --> 00:00:14.240 To start, 00:00:14.250 --> 00:00:16.740 we'll take a look at installing Suricata and discuss the 00:00:16.740 --> 00:00:19.490 specifics of how the training VM has been configured. 00:00:19.680 --> 00:00:22.520 We'll also review networking in the training VM and some of the key 00:00:22.520 --> 00:00:25.550 files used by Suricata for output and configuration. 00:00:27.340 --> 00:00:29.790 Since our training VM is based off of Ubuntu Linux, 00:00:30.110 --> 00:00:33.880 the preferred method of installing Suricata is to use the OISF PPA, 00:00:33.890 --> 00:00:35.650 or Personal Package Archive. 00:00:36.140 --> 00:00:39.760 This ensures that you will install the latest stable version of Suricata. 00:00:40.440 --> 00:00:43.980 You will find full installation instructions under Binary Packages, 00:00:43.990 --> 00:00:47.710 Ubuntu in the Suricata user guide on Read the Docs, 00:00:47.830 --> 00:00:50.760 as well as a wealth of other information for using Suricata. 00:00:51.840 --> 00:00:53.970 You will also find installation instructions for 00:00:53.970 --> 00:00:57.860 not only other operating systems, but other methods for installing Suricata. 00:00:58.240 --> 00:01:00.270 While some of the specifics will vary, 00:01:00.530 --> 00:01:02.730 the installation procedure will be very similar 00:01:02.730 --> 00:01:04.620 among supported operating systems. 00:01:06.140 --> 00:01:06.490 Now, 00:01:06.500 --> 00:01:09.900 for those of you already thinking about your production Suricata installation, 00:01:09.910 --> 00:01:11.860 here are some other installation methods. 00:01:12.540 --> 00:01:16.390 First, RPM Package Manager repositories for Red Hat Enterprise Linux, 00:01:16.560 --> 00:01:18.260 CentOS, and Fedora. 00:01:18.940 --> 00:01:21.060 There is an installer for Microsoft Windows. 00:01:21.440 --> 00:01:24.160 And you also have the ability to build from source. 00:01:24.940 --> 00:01:25.690 And finally, 00:01:25.690 --> 00:01:28.060 you may also be able to use the package manager from 00:01:28.060 --> 00:01:30.280 your favorite operating system, such as Arch Linux, 00:01:30.400 --> 00:01:32.460 FreeBSD, and OpenBSD. 00:01:33.540 --> 00:01:36.080 Keep in mind that these package managers may install a version of 00:01:36.080 --> 00:01:39.080 Suricata that is well behind the current stable version, 00:01:39.120 --> 00:01:42.660 and you may want to check the version of Suricata that is installed. 00:01:43.240 --> 00:01:44.330 As you might have guessed, 00:01:44.340 --> 00:01:48.180 we recommend running the latest stable version of Suricata for performance, 00:01:48.190 --> 00:01:50.050 capabilities, and security. 00:01:51.740 --> 00:01:56.120 The Suricata training VM is based off of Ubuntu 20.04 long‑term 00:01:56.120 --> 00:01:59.840 support, and Suricata is installed using the OISF PPA. 00:01:59.840 --> 00:02:03.970 The primary configuration file for Suricata will be placed in 00:02:03.980 --> 00:02:07.260 /etc/suricata and is named suricata.yml, 00:02:07.260 --> 00:02:08.949 or yaml. 00:02:09.639 --> 00:02:13.200 YAML is a popular way of creating human‑readable configuration files, 00:02:13.210 --> 00:02:16.580 and the installation uses an example configuration, so it's 00:02:16.580 --> 00:02:19.080 helpful to get to know more about this file and when you 00:02:19.080 --> 00:02:20.600 need to make modifications to it. 00:02:21.830 --> 00:02:26.100 The logging location for Suricata is /var/log/suricata when Suricata is 00:02:26.100 --> 00:02:29.260 running in service mode or listening to live network traffic. 00:02:29.840 --> 00:02:33.490 When replaying pcaps, commonly referred to as offline mode, 00:02:33.670 --> 00:02:35.750 Suricata will log to the current directory. 00:02:36.050 --> 00:02:39.950 This is done to avoid any conflicts with the live logs, and there is a 00:02:39.950 --> 00:02:42.460 command line option to define this logging location. 00:02:43.040 --> 00:02:45.050 Don't worry, we'll get into the differences in these 00:02:45.050 --> 00:02:46.620 two modes later in the course. 00:02:48.090 --> 00:02:51.950 Suricata‑Update is the recommended tool for updating the rules that your 00:02:51.950 --> 00:02:56.300 Suricata instance is using. Out of the box, Suricata‑Update is configured 00:02:56.300 --> 00:03:00.010 to use the Emerging Threats open ruleset and will load these rules from 00:03:00.010 --> 00:03:05.210 /var/lib/suricata/rules/suricata.rules. Right now, we just want you to 00:03:05.210 --> 00:03:06.760 focus on the default behavior. 00:03:06.770 --> 00:03:10.730 We'll also get into managing rules using Suricata‑Update 00:03:10.730 --> 00:03:15.420 later in this course. For training purposes, 00:03:15.420 --> 00:03:18.330 we have set up the VM to use a dummy network interface. 00:03:18.480 --> 00:03:21.720 This will provide a live‑like experience without having the extra 00:03:21.720 --> 00:03:25.050 overhead of not only listening to live network traffic, but in 00:03:25.050 --> 00:03:27.260 capturing potentially malicious traffic. 00:03:28.640 --> 00:03:32.550 This creates an ideal setup in that we can easily share pcaps to provide 00:03:32.550 --> 00:03:36.060 network traffic of interest without having to spend the time setting up 00:03:36.060 --> 00:03:40.450 Suricata within a real network. By replaying to the dummy interface, 00:03:40.460 --> 00:03:44.270 Suricata will see it as live traffic, allowing it to generate metadata, 00:03:44.270 --> 00:03:45.520 as well as any alerts. 00:03:45.910 --> 00:03:48.890 The use of the dummy interface also prevents other operating 00:03:48.890 --> 00:03:50.980 system traffic from showing up in our logs, 00:03:51.080 --> 00:03:53.160 keeping us focused on the traffic at hand. 00:03:54.140 --> 00:03:57.870 Another mode of operation for Suricata is offline mode in which 00:03:57.870 --> 00:04:00.560 Suricata will process network traffic and pcap files. 00:04:01.140 --> 00:04:03.890 One of the biggest drawbacks to this approach is that Suricata 00:04:03.890 --> 00:04:07.320 will generate data based on the timestamp from the pcap, so if 00:04:07.320 --> 00:04:08.790 the pcap is several months old, 00:04:08.800 --> 00:04:11.570 we'll have to adjust all of our filters or queries to see 00:04:11.570 --> 00:04:14.410 that traffic. By the end of this course, 00:04:14.420 --> 00:04:17.149 you'll have a great understanding of Suricata's different modes of 00:04:17.149 --> 00:04:20.050 operation and how to set it up based on your needs. 00:04:21.240 --> 00:04:24.840 What else does the training VM include? A full Ubuntu 00:04:24.840 --> 00:04:32.100 LTS graphical desktop environment, popular text editors, such as vi and nano, jq, 00:04:32.160 --> 00:04:36.500 which is a common tool for viewing and processing JSON data. Since Suricata's 00:04:36.500 --> 00:04:41.050 main log file is in the JSON format, this tool allows us to efficiently view 00:04:41.050 --> 00:04:44.690 and query its contents. And finally, EveBox, 00:04:44.930 --> 00:04:48.450 which is a web‑based GUI for viewing and searching Suricata data. 00:04:49.840 --> 00:04:52.370 Suricata generates a lot of output, 00:04:52.440 --> 00:04:55.580 everything from alerts to network metadata, such as DNS 00:04:55.580 --> 00:04:58.110 requests or HTTP request‑response. 00:04:58.420 --> 00:04:59.200 In fact, 00:04:59.290 --> 00:05:03.050 this is one of the primary reasons to run Suricata, to generate this 00:05:03.050 --> 00:05:08.050 output. In a basic production setup, Suricata output can be seen in 00:05:08.050 --> 00:05:13.060 /var/log/suricata. You can view this folder in the training VM to get a 00:05:13.060 --> 00:05:18.490 sense of what files and what data will be present there. In 00:05:18.490 --> 00:05:22.080 /var/log/suricata, there are a few files that are worth pointing out 00:05:22.090 --> 00:05:23.940 before we get too far into the course. 00:05:24.640 --> 00:05:29.790 The first, and primary, is eve.json. This file, in the JSON format, 00:05:29.790 --> 00:05:32.960 contains the data for alerts and other network events. 00:05:33.440 --> 00:05:35.470 Don't worry if you're not familiar with JSON, 00:05:35.480 --> 00:05:37.230 you'll have plenty of opportunities to gain 00:05:37.230 --> 00:05:39.160 experience with it throughout this course. 00:05:40.040 --> 00:05:44.060 Fast.log. This is a simple text file that contains only alert data. 00:05:44.540 --> 00:05:47.890 This may be familiar to those coming to Suricata from other intrusion 00:05:47.890 --> 00:05:52.340 detection systems. Stats.log is a text file in tabular format that 00:05:52.340 --> 00:05:55.060 contains metrics about the Suricata engine performance. 00:05:55.940 --> 00:05:59.310 Suricata.log is a log file from Suricata itself, 00:05:59.320 --> 00:06:03.760 which may include such information as startup errors. Filestore is 00:06:03.760 --> 00:06:06.460 a directory where extracted files can be found. 00:06:07.040 --> 00:06:09.390 File extraction is not enabled by default, 00:06:09.400 --> 00:06:14.260 but we'll cover how to do this in more detail a little bit later on. Now 00:06:14.260 --> 00:06:16.950 that you have an idea of where all of this data lives, 00:06:17.120 --> 00:06:20.150 let's take a look at it in our training VM in our next demonstration.