Scribd
Upload
139 views7 pages

HOW TO Windows

This document provides instructions for installing and running Suricata IDS/IPS on Windows. It notes that npcap must be installed first. Rules are needed and various sources are listed for obtaining rules. The Suricata configuration file suricata.yaml is explained, including logging and rules directories, and HOME_NET settings. To run Suricata, the command suricata.exe is used along with flags for the configuration file and interface. Un-IP'd interfaces can also be used by getting the NIC UUID. More documentation is available online.

Uploaded by

Itachi Kanade Eucliwood
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
139 views7 pages

HOW TO Windows

This document provides instructions for installing and running Suricata IDS/IPS on Windows. It notes that npcap must be installed first. Rules are needed and various sources are listed for obtaining rules. The Suricata configuration file suricata.yaml is explained, including logging and rules directories, and HOME_NET settings. To run Suricata, the command suricata.exe is used along with flags for the configuration file and interface. Un-IP'd interfaces can also be used by getting the NIC UUID. More documentation is available online.

Uploaded by

Itachi Kanade Eucliwood
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 7

Suricata IDS/IPS

Help and Quick Start Guide


Instructions for Windows
tested on Windows 10, Windows Server 2012R2/2016 64 bit.

Date: 27 August 2018

Author: Peter Manev (pevma)


Before you start Suricata IDS/IPS

You MUST have npcap(npcap win installer) installed in order to run Suricata IDS/IPS !

Rules

You will need rules, because Suricata inspects traffic based on rules. The rules usually
reside in the “INSTALLDIR\rules” directory. There are non-installed by default. You can
install them in any directory you wish, just make sure you change the path in the
suricata.yaml configuration file.

You can get them from:

• ProofPoint(Emerging Threads - ETPro ruleset) – the rules there are specially


tailored for Suricata, in order to use its advanced and specific features to the
maximum. You can also use the free ET Open ruleset.

• Write them yourself – if you have previous experience or you would like just a
specific traffic to be inspected, you can write the necessary rules by yourself. You
can find some more info on rule writing here:

• Suricata Rule Writing Manual

After you have the rules – specify which rules would you like to activate or deactivate.
For example, if you would like to deactivate a rule put a “#” at the beginning of the line:
The ones in green above are deactivated.

Configuration

It is important that you configure Suricata properly.

Suricata’s configuration file is called “suricata.yaml” and holds special syntaxes and all
your configurational variables – i.e. networks, interfaces, log files locations/rules
directories and many more.

Suricata.yaml already has default values and config options, here we will go over some
of them very briefly, so that you can get acquainted better.

For example , if you are not happy with the default options you can change them –
”default-log-dir: C:\Suricata\log

………

- file:

enabled: yes

filename: C:\\Suricata\\suricata.log

……….

default-rule-path: C:\\Suricata\\rules\\

classification-file: C:\\Suricata\\classification.config

…….

HOME_NET: "[192.168.0.0/16]" - (here actually you put any network you want Suricata to
inspect)

similar to the pic below:


NOTE: Please make sure that the directories are created or exist if you change from the default ones

Running Suricata

Open a cmd and go to your Suricata Directory OR just double click the icon on your
desktop and execute:

suricata.exe -c suricata.yaml -i 10.0.2.15

like shown on the picture below (in this case – 10.0.2.15 is the IP/interface I want
Suricata to listen to, i.e. the IP that my network card has been configured with):

And you have yourself Suricata running:


NOTE:

If you need to run Suricata on a un-ip'd interfaces (thanks to Rich Rumble for pointing
that out):

You can get the NIC UUID in a variety of ways, the simplest is using a single command
for WMIC:(from cmd prompt paste in the following)

wmic nicconfig get ipaddress,SettingID

If you know your NIC's IP you can filter the results with findstr:

wmic nicconfig get ipaddress,SettingID | findstr 1.2.3.4

(replace 1.2.3.4 with your NIC's IP)

Then use that as your interface argument example:

C:\Program Files\Suricata>suricata.exe -i \\DEVICE\\NPF_\{D53813F6-9382-4292-


93A0-DA131DA66D9F\}

Make sure the double slashes are used, and a backslash is placed before the curly
braces!

More Info and Documentation

You can find much more info about setting up and tuning Suricata here:

https://suricata.readthedocs.io/en/latest/what-is-suricata.html

You might also like