Suricata - IDS/IPS. Observe Protect Adapt

Start observing, protecting, and adapting your network with Suricata to monitor, analyze, and detect network threats in real time.

Suricata

Suricata is a high performance, open source network analysis and threat detection software used by most private and public organizations, and embedded by major vendors to protect their assets.

Suricata generates structured EVE logs collected to Wazuh, enabling centralized detection, correlation, and analysis of network security events.

Requirements (Suricata host):

• Wazuh XDR/SIEM installed
• Ubuntu 16.04–24.04 (64-bit)
• x86_64/ARM64
• Root privileges
• CPU 4vCPU, RAM 8GB, Storage 50GB

Install Suricata:

sudo apt-get install software-properties-common
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
sudo apt-get install suricata jq

Configure Suricata host:

sudo nano /etc/suricata/suricata.yaml

HOME_NET: "<UBUNTU_IP>"
EXTERNAL_NET: "any"

default-rule-path: /etc/suricata/rules
rule-files:
  - "*.rules"

stats:
  enabled: yes

af-packet:
  - interface: enp0s3

Replace <UBUNTU_IP> with your system’s IP address and adjust the interface name enp0s3 to match your environment.

sudo systemctl restart suricata

Configure Suricata rules:

cd /tmp/
curl -LO https://rules.emergingthreats.net/open/suricata-8.0.1/emerging.rules.tar.gz

sudo tar -xvzf emerging.rules.tar.gz
sudo mkdir /etc/suricata/rules
sudo mv rules/*.rules /etc/suricata/rules/
sudo chmod 777 /etc/suricata/rules/*.rules

Review Suricata status:

sudo systemctl status suricata

tail -f /var/log/suricata/eve.json | jq .

Requirements (Wazuh agent):

• Ubuntu/Debian Linux (64-bit)
• Root privileges

Configure Wazuh agent:

sudo nano /var/ossec/etc/ossec.conf

<localfile>
  <log_format>json</log_format>
  <location>/var/log/suricata/eve.json</location>
</localfile>

sudo systemctl restart wazuh-agent

Review Suricata via Wazuh dashboard:

ping -c 20 "<UBUNTU_IP>"

• Log in to Wazuh dashboard
• Open Threat Hunting rule.groups:suricata

Suricata alerts are collected into Wazuh, giving security teams centralized insight and the ability to monitor, analyze, and respond to security threats.