Questions tagged [suricata]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
59 views

Suricata bypass keyword

I have not found any examples on using the 'bypass' keyword. Does it work in any rule? Are there performance implications using 'bypass'. For example, would this bypass all tcp traffic? alert tcp any ...
0
votes
1answer
38 views

Suricata not matching a packet

What happens to a packet that has no matching rule in Suricata. I assume it is ignored, but haven't found any definitive info on this. So, if my assumption is correct and the packet is ignored, would ...
0
votes
0answers
48 views

How can I get Packet length from Suricata output?

In snort I can easely get packet length attribute (pkt_len) related to an alert. However in Suricata I don't see these information in JSON alerts (from eve.json). How can I get these information?
0
votes
0answers
111 views

Snort Rule to check for TCP options

Lets say malformed packets are sent by attacker with improper TCP options length i.e, 50bytes,222bytes etc. Is there any way to monitor these packets having invalid tcp options set using Snort or ...
1
vote
1answer
182 views

Custom Suricata's HTTP alert isn't triggered when using “..” as part of the scanned uri. Why? [closed]

I have a doubt with a Suricata custom rule. If I do: alert http any any -> any 80 (msg:"blabla"; content:"abc"; http_uri; sid:1000000;) I can get requests to http://x.x.x.x/abc uri in fast.log ...
0
votes
1answer
316 views

Loopback with Suricata

Is there any way of analyzing loopback traffic with Suricata? I am trying it this way without success: root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
0
votes
1answer
372 views

Analyzing Apache log with Snort

I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
0
votes
1answer
249 views

Virustotal detecting threats in Suricata rule set

Virustotal scans are detecting threats from the Suricata default rule pack located https://rules.emergingthreats.net/open/suricata-4.0/ Is this a false positive? https://www.virustotal.com/#/file/...
2
votes
0answers
354 views

How can I get Suricata to alert on 1 packet every time

I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought. ...