Suricata & Snort — IDS/IPS Configuration

# Ubuntu/Debian
add-apt-repository ppaoisf/suricata-stable
apt update && apt install -y suricata
# Vérification
suricata --version
suricata-update  # MAJ des règles Emerging Threats

# docker-compose.yml
services:
  suricata:
    image: jasonish/suricata:latest
    network_mode: host
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - SYS_NICE
    volumes:
      - ./suricata.yaml:/etc/suricata/suricata.yaml
      - ./rules:/var/lib/suricata/rules
      - ./logs:/var/log/suricata
    command: -i eth0

# /etc/suricata/suricata.yaml
# Réseau local
vars:
  address-groups:
    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
    EXTERNAL_NET: "!$HOME_NET"
  port-groups:
    HTTP_PORTS: "80,8080,8443"
    SHELLCODE_PORTS: "!80"
# Outputs
outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: eve.json
      types:
        - alert
        - http
        - dns
        - tls
        - flow
        - ssh
# Interface
af-packet:
  - interface: eth0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
# Règles
rule-files:
  - suricata.rules
  - /var/lib/suricata/rules/emerging-threats.rules

action proto src_ip src_port direction dst_ip dst_port options

# Détection scan nmap SYN
alert tcp $EXTERNAL_NET any > $HOME_NET any 
  msg"SCAN nmap SYN Stealth"; flagsS12; 
  thresholdtype thresholdtrack by_srccount 20seconds 1; 
  sid1000001; rev1;
# Détection SQLi basique
alert http $EXTERNAL_NET any > $HTTP_SERVERS $HTTP_PORTS 
  msg"SQL Injection attempt"; 
  content"' OR"; http_uri; nocase; 
  sid1000002; rev1;
# Détection shell inverse
alert tcp $HOME_NET any > $EXTERNAL_NET any 
  msg"Possible Reverse Shell - /bin/bash"; 
  content"/bin/bash"; 
  sid1000003; rev1;
# Exfiltration DNS (requêtes longues suspectes)
alert dns any any > any 53 
  msg"DNS exfiltration - long subdomain"; 
  dnsquery; content"."; 
  byte_test1>500stringdec; 
  sid1000004; rev1;
# Détection Mimikatz via SMB
alert smb any any > $HOME_NET any 
  msg"Possible Mimikatz - lsass dump via SMB"; 
  content"lsass"; nocase; 
  sid1000005; rev1;

# Activer NFQueue
suricata -c /etc/suricata/suricata.yaml -q 0
# iptables pour rediriger le trafic
iptables -I FORWARD -j NFQUEUE --queue-num 0
iptables -I INPUT -j NFQUEUE --queue-num 0
iptables -I OUTPUT -j NFQUEUE --queue-num 0
# Dans suricata.yaml : mode = repeat (drop le trafic)
nfq
  mode repeat
  repeat-mark: 1
  repeat-mask: 1
  bypass-mark: 1
  bypass-mask: 1

# Installation Snort 3
apt install -y snort3
# Configuration /etc/snort/snort.lua
HOME_NET  "192.168.0.0/16"
EXTERNAL_NET  "!$HOME_NET"
# Règle Snort 3
alert tcp $EXTERNAL_NET any > $HOME_NET 22 
  msg"SSH Brute Force"; 
  detection_filtertrack by_src count 5 seconds 60; 
  sid2000001;
# Lancement
snort -c /etc/snort/snort.lua -i eth0 -A alert_fast

# Filebeat module suricata
filebeat.modules:
  - module: suricata
    eve:
      enabled: true
      var.paths: ["/var/log/suricata/eve.json"]
output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "suricata-%{+yyyy.MM.dd}"

# Importer dashboards Suricata
filebeat setup --dashboards
# Index pattern : suricata-*
# Champs clés : alert.signature, src_ip, dest_ip, proto

# suricata-update (Emerging Threats)
suricata-update list-sources
suricata-update enable-source et/open
suricata-update
# Cron quotidien
0 3    /usr/bin/suricata-update && systemctl reload suricata