We're now ready to take a tour of the training VM, but first things first,
getting logged in.
The username for the training VM is Suricata with a password of password,
no special characters, all lowercase.
This account also has pseudo privileges,
which means that any time you need root,
that is administrative rights, you'll be able to use it.
Once you log in, you'll be presented with your desktop.
The first thing you'll notice is some icons on the desktop.
The most important, at least for right now, is the links‑helpful‑info.html.
Let's go ahead and double‑click this to open this page in the default browser,
which is Firefox.
This file provides many direct links to not only resources in the training VM,
but other online tools that you may find helpful throughout the course.
Under the Local tools section is Evebox,
which we'll explore in more detail later in the course.
Next is IP lookup sites.
These sites can be used when researching potentially malicious
activity based off of such data as IP addresses,
domain names, file hashes,
and other data that Suricata can generate while inspecting network traffic.
The last bit of information is notes about the training VM,
such as location for the pcaps we'll be using,
useful Suricata commands, and default paths for logs and configuration files.
For our next step, we're going to open up a terminal.
You can do this by clicking on the text, Activities, in the upper
left‑hand corner and type in the word terminal.
You'll have two options.
The first is the standard terminal that comes with Ubuntu Linux.
The second is Terminator which is a terminal emulator.
We're going to go ahead and open up Terminator.
We chose Terminator, as it allows for a flexible arrangement of terminals.
As you can see by right‑clicking in the terminal space,
we can do things like split the terminal horizontally,
vertically or even create new tabs.
It also lets you do things like copy and paste using keyboard shortcuts.
For right now, though, we only need one terminal open,
so I'm going to go ahead and close that second one. Let's talk
about a few helpful commands now. The first one up is suricata
‑V. This will provide you with information about the version of
Suricata that is installed.
So, keep in mind, if you install Suricata in your own VM,
you may want to check this value to ensure you are on the
latest stable version. Not sure what the current Suricata
version is? You can always go to the Suricata website and get
that information on the home page.
The next command is ip a. This will show all the network interfaces. Here
you can see the local interface, lo; the main interface, ens33; and the
dummy interface, dummy0. Depending on your virtualization software, your
primary interface may have a different name.
This should not cause any issues, as we'll be replaying traffic to
the dummy interface, though. Shortly, we'll also look at the
scripts we'll use to replay pcaps, and you can note the use of
this interface in those scripts.
This will provide you additional insight into how
we set up the dummy networking.
The default log location is var/log/suricata. Let's now run the
command ls /var/log/suricata to see all the files we discussed such
as eve.json, stats.log, and fast.log.
No need to investigate any of these files just yet.
We just want to ensure you know where they are located.
When you open a terminal, by default,
you'll be in the user's home directory, home/suricata. Let's now change
to the training directory with the cd command and list the contents.
Here are several important files and folders.
The pcaps folder will contain all of the training
pcaps we'll use throughout the course.
This includes not only demonstrations, but exercises and labs. Setup
will contain scripts used during the initial configuration, so you
shouldn't have to use those. However,
we kept them in the VM so that anyone interested could take a deeper look.
Finally,
there are two scripts, suri‑ingest‑pcap.sh and suri‑replay‑pcap.sh.
We'll use both of these scripts to replay pcaps to Suricata. The
ingest‑pcap script is for Suricata in offline mode, while the
replay‑pcap will utilize tcpreplay to replay the pcap to the dummy
interface, as we discussed previously.
Next, let's take a look at the replay script, as there are a
few behaviors I want you to be aware of.
I'm going to go ahead and use vi as my text editor, so we'll use the
command vi, and then the name of our file. First,
every time the script runs it will clear Suricata logs at /var/log/suricata.
This helps us to stay focused on the traffic from the current pcap and not
get distracted or confused with previous data.
The script will also clear evebox logs, which serves the same purpose when we
are viewing Suricata data, but in a web‑based UI. Next,
it would use tcpreplay to replay the pcap at a slightly accelerated speed.
If we didn't speed up the replay,
then you would have to wait the duration of the original
capture. Too fast though, and it makes it harder to see a
clear timeline or sequence of events.
Finally, the script will use jq to not only filter data in the eve.json file,
but also to pretty_print the output.
Let's see this script in action.
Our replay script needs root privileges, so we'll start this command with
sudo. Then we will use a ./ to indicate that we want to execute a file in
the current directory followed by the script name.
This script takes one argument, the path to a pcap file.
We'll use a pcap that contains traffic from a malicious
Office document that downloads a Trojan, in this case,
icedid. Due to the use of sudo,
you may be prompted for the password for the Suricata account.
All you need to do is enter our password, which is password.
The script will take a few moments to execute, and the larger the pcap,
the longer this time will take, even though we have the playback slightly
accelerated. You'll know when the script has completed because you'll be
returned to a normal terminal.
Not all pcaps are going to generate alerts,
but in this case we have one that was quite noisy. While alerts
provide valuable information, this isn't all of the data that
Suricata generates from network traffic.
We're going to continue to dig deeper into this and
much more throughout the course.