Thanks to the EVE JSON events and alerts format that appear in Suricata 2.0, it is now easy to import Suricata generated data into a running Splunk.
To ease the first steps of integration, Stamus Networks is providing a Splunk application: Suricata by Stamus Networks
It can be installed like any other applications and it just requires that a Suricata EVE JSON file is known and parsed by Splunk.
Current version is providing a dashboard and a few searches:
This post describes how to import the application and if you don’t have already done it how to import data from a Suricata EVE file.
Importing the application is done via the Apps menu on top of Splunk starting page:
Suricata by Stamus Networks application is currently provided as a file, so you need to download it: Suricata by Stamus Networks. Once done, you can add the application:
You need to select the file
Since splunk 6.1.x, the recognition of the file format is automatic. If you are using an older version of Splunk, you may need to refer to this page to import Suricata EVE file.
Here’s the detailed procedure to import Suricata EVE data into Splunk. From the starting page, we click on Add Data:
Then we click an Files & Directories to tell Splunk to import data from Suricata EVE JSON file:
Once done, we click on the New button:
Now, we only need to give the complete path to the eve.json file:
Once this is done, we just need to click on all Continue buttons to be done.
Now, we can go to the application by clicking on Suricata by Stamus Networks:
Next step can be to to go the dashboard:
The dashboard contains some interesting panels like the following one who displays the destination IP addresses that are using a self-signed certificate for TLS connections:
This application should evolve with time, so stay tuned and follow us on twitter for more information.
Stamus Networks is proud to announce the release of SELKS 1.0 beta2. This is the second public release of our Live and installable ISO implementing a ready to use Suricata IDS/IPS.
SELKS 1.0 beta2 can be downloaded:
MD5 sum of the SELKS-1.0beta2.iso file is 38222aeda399f7502913c91465ac9499.
If this new release features some improvements in the creation process, the main new things for the user are an updated version of Scirius and a custom Kibana interface. A menu to switch from one interface to the other has been added on both application. A link has been added in the detail of alert event to be able to jump from Kibana to the correct place in Scirius rule management. The following screencast demonstrates these features:
On Suricata side, file extraction and Unix socket are now enable by default. So SELKS 1.0-beta2 will extract to disk files from stream if signatures containing the filestore are used. The activation of Unix socket allows user to get data from Suricata and/or to use alternate running modes like multiple pcap processing.
The complete Changelog is as follows:
The Ubuntu used in this tutorial:
root@LTS-64-1:~/opt#uname -a
Linux LTS-64-1 3.5.0-45-generic #68~precise1-Ubuntu SMP Wed Dec 4 16:18:46 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
If you have these packages installed you need to remove them so that Scirius would work with the latest python dependencies.
Please be careful so that this actually does not affect your current running services. It is always best to test first 🙂
root@LTS-64-1:~/opt#apt-get remove django-tables python-django python-django-south python-git
Install the needed dependencies:
root@LTS-64-1:~/opt#aptitude install python-pip git
root@LTS-64-1:~/opt#pip install django django-tables2 South GitPython pyinotify daemon
Clone the latest version
root@LTS-64-1:~/opt#git clone https://github.com/StamusNetworks/scirius.git
root@LTS-64-1:~/opt#cd scirius/
root@LTS-64-1:~/opt/scirius# python manage.py syncdb
Start Scirius
root@LTS-64-1:~/opt/scirius#python manage.py runserver
Validating models…
Failed to setup thread-interrupt handler. This is usually not critical
0 errors found
May 20, 2014 – 19:51:27
Django version 1.6.4, using settings ‘scirius.settings’
Starting development server at http://127.0.0.1:8000/
Quit the server with CONTROL-C.
If you need to connect to the server remotely (provide your ip)Â –
root@LTS-64-1:~/opt/scirius#python manage.py runserver 10.0.10.5:8000
Validating models…
Failed to setup thread-interrupt handler. This is usually not critical
0 errors found
May 20, 2014 – 19:51:58
Django version 1.6.4, using settings ‘scirius.settings’
Starting development server at http://10.0.10.5:8000/
Quit the server with CONTROL-C.
Now lets have a walk through registering and adding a ruleset
For example (for the latest stable and dev Suricata) from http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz since Emerging Threats create, write and distribute specially tuned for Suricata rulesets that make use of the advanced features of that IDS engine.
First we need to add a source:
Then we add a ruleset:
We need to edit the ruleset and select the categories we want from that ruleset:
Select categories:
Validate changes:
If you have already Elasticsearch, Logstash, Kibana installed on the same server,
you could do the following -> put in the values as on the picture – except the host name – chose the hostname to be exactly as your hostkey in Elasticsearch/Kibana , like in the pics below.
Then in Scirius ->
Now you should be able to see the hits and which rules are making the most noise 🙂
That’s it for a quick intro.
Stamus Networks is proud to announce the release 0.3 of Scirius, our web interface for Suricata ruleset management.
The interface has been redesigned for more compacity and clarity:
Two major features have been added:
It is now also possible to select the time period selection on rules activity:
Please note, the rules with sid 220029 on the screenshot. It is displayed strikethrough because it has been suppressed from the ruleset.
Here’s a screencast showing how easy it is to suppress a noisy rule from a ruleset:
With all these new features, we think that Scirius can now be efficiently used to administrate a Suricata ruleset.
Stamus Networks is happy to release Scirius as Open Source Software under GPLv3. You can download it from GitHub : scirius-0.3.tar.gz.
Stamus Networks is proud to announce the first release of Scirius, its Suricata ruleset web management interface.
Scirius is a web management interface developed by Stamus Networks and released under the GPLv3 license. The interface is aiming simplicity and efficiency and that’s why we have adopted a simple design:
It is possible to link Scirius with a running Elasticsearch fed by Suricata EVE JSON log. Once done, information stored in the Elasticsearch can be used to get an idea of the activity of the Suricata. The following screenshot is an example of statistics fetched from Elasticsearch and displayed in Scirius:
Scirius is currently in alpha stage but it is already possible to manage efficiently a Suricata ruleset using ETOpen or ETPro ruleset. For example, the following video is demonstrating how it is possible to remove a selected subset of signatures from the ruleset:
Scirius is available on Github. Following releases of Scirius will feature among other things the support for local signatures (uploaded by the user) and some missing operations such as quick removal of individual signature.
I’ve given a talk entitled “Suricata 2.0, Netfilter and the PRC” at the Hackito Ergo Sum conference.
The talk is presenting Suricata and the new features available in version 2.0, focusing on the new EVE output and how it can be used with Elasticsearch, Logstash and Kibana. I’ve also shown how ulogd, the Netfilter logging daemon can be used with Elasticsearch thanks to the new JSON output plugin. Finally, I’ve explained how I’ve discovered a attack schema which is originating from systems running in the People Republic of China.
You can get the slides here:Â Suricata 2.0, Netfilter and the PRC
This is the first blog post on Stamus Networks technical blog. You will find here posts focused on Intrusion Detection System and Network Security Monitoring as well as information specific to Suricata or our products.