Questions tagged [suricata]

Suricata refers to the multi-threaded Snort implementation.

Suricata is is a multi-threaded fork of the open source IDS known as Snort that is owned and maintained by the OISF (Open Information Security Foundation). Unlike Snort, Suricata supports balancing the analysis load across multiple instances of the tool, allowing better overall utilization of the available processor cores and faster performance.

80 questions
0
votes
2 answers

Suricata conditional alerts

I'm asking about Suricata Is there way to write a conditional alert? For example - alert of HTTP GET if the server status to the request is "success" Thanks, Efrat
Efrat Levy
  • 109
  • 3
  • 6
-1
votes
2 answers

Cannot connect localhost Evebox on docker

I use docker-compose to start Evebox, but I cannot connect it on localhost:5636. A part of my docker-compose file : evebox: image: jasonish/evebox:master volumes: - /var/log/suricata:/var/log/suricata links: - elasticsearch …
-1
votes
1 answer

Suricata to monitor entire network

How to configure Suricate to capture packets on the entire network? I have already configured the Suricate but it's only capturing packets that send to Suricata installed host. I want the whole network packets to be captured by Suricata. I have two…
Shann
  • 311
  • 1
  • 2
  • 9
-1
votes
1 answer

Add some text after :" using sed?

Can anyone help me create a script that adds [ SURICATA ] in this log file? alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN SQL Injection Attempt (Agent uil2pn)"; flow:to_server,established; content:"$
-2
votes
1 answer

Is it possible to write a Python (iOS) program to allow/execute commands to a RaspberryPi?

I am currently underway with my Senior Capstone project, in which I am to write a somewhat basic program which allows a custom interface on my iPhone6 device to remotely control or issue critical commands to a NIDS (Suricata) established at my home…
davy301
  • 9
  • 1
1 2 3 4 5
6