Suricata User Guide

• 1. What is Suricata
  • 1.1. About the Open Information Security Foundation
• 2. Quickstart guide
  • 2.1. Installation
  • 2.2. Basic setup
  • 2.3. Signatures
  • 2.4. Running Suricata
  • 2.5. Alerting
  • 2.6. EVE Json
• 3. Installation
  • 3.1. Source
  • 3.2. Binary packages
  • 3.3. Advanced Installation
• 4. Upgrading
  • 4.1. General instructions
  • 4.2. Upgrading to 6.0.13
  • 4.3. Upgrading from 6.0.4 to 6.0.5
  • 4.4. Upgrading 5.0 to 6.0
  • 4.5. Upgrading 4.1 to 5.0
• 5. Security Considerations
  • 5.1. Running as a User Other Than Root
  • 5.2. Containers
• 6. Command Line Options
  • 6.1. Unit Tests
• 7. Suricata Rules
  • 7.1. Rules Format
  • 7.2. Meta Keywords
  • 7.3. IP Keywords
  • 7.4. TCP keywords
  • 7.5. UDP keywords
  • 7.6. ICMP keywords
  • 7.7. Payload Keywords
  • 7.8. Transformations
  • 7.9. Prefiltering Keywords
  • 7.10. Flow Keywords
  • 7.11. Bypass Keyword
  • 7.12. HTTP Keywords
  • 7.13. File Keywords
  • 7.14. DNS Keywords
  • 7.15. SSL/TLS Keywords
  • 7.16. SSH Keywords
  • 7.17. JA3 Keywords
  • 7.18. Modbus Keyword
  • 7.19. DNP3 Keywords
  • 7.20. ENIP/CIP Keywords
  • 7.21. FTP/FTP-DATA Keywords
  • 7.22. Kerberos Keywords
  • 7.23. SNMP keywords
  • 7.24. Base64 keywords
  • 7.25. SIP Keywords
  • 7.26. RFB Keywords
  • 7.27. MQTT Keywords
  • 7.28. HTTP2 Keywords
  • 7.29. Generic App Layer Keywords
  • 7.30. Xbits Keyword
  • 7.31. Thresholding Keywords
  • 7.32. IP Reputation Keyword
  • 7.33. Config Rules
  • 7.34. Datasets
  • 7.35. Lua Scripting
  • 7.36. Differences From Snort
• 8. Rule Management
  • 8.1. Rule Management with Suricata-Update
  • 8.2. Adding Your Own Rules
  • 8.3. Rule Reloads
• 9. Making sense out of Alerts
• 10. Performance
  • 10.1. Runmodes
  • 10.2. Packet Capture
  • 10.3. Tuning Considerations
  • 10.4. Hyperscan
  • 10.5. High Performance Configuration
  • 10.6. Statistics
  • 10.7. Ignoring Traffic
  • 10.8. Packet Profiling
  • 10.9. Rule Profiling
  • 10.10. Tcmalloc
  • 10.11. Performance Analysis
• 11. Configuration
  • 11.1. Suricata.yaml
  • 11.2. Global-Thresholds
  • 11.3. Exception Policies
  • 11.4. Snort.conf to Suricata.yaml
  • 11.5. Multi Tenancy
  • 11.6. Dropping Privileges After Startup
• 12. Reputation
  • 12.1. IP Reputation
• 13. Init Scripts
• 14. Setting up IPS/inline for Linux
  • 14.1. Setting up IPS with Netfilter
  • 14.2. Settings up IPS at Layer 2
• 15. Setting up IPS/inline for Windows
• 16. Output
  • 16.1. EVE
  • 16.2. Lua Output
  • 16.3. Syslog Alerting Compatibility
  • 16.4. Custom http logging
  • 16.5. Custom tls logging
  • 16.6. Log Rotation
• 17. Lua support
  • 17.1. Lua usage in Suricata
  • 17.2. Lua functions
• 18. File Extraction
  • 18.1. Architecture
  • 18.2. Settings
  • 18.3. Output
  • 18.4. Rules
  • 18.5. MD5
  • 18.6. Updating Filestore Configuration
• 19. Public Data Sets
• 20. Using Capture Hardware
  • 20.1. Endace DAG
  • 20.2. Napatech
  • 20.3. Myricom
  • 20.4. eBPF and XDP
  • 20.5. Netmap
• 21. Interacting via Unix Socket
  • 21.1. Introduction
  • 21.2. Commands in standard running mode
  • 21.3. Commands on the cmd prompt
  • 21.4. PCAP processing mode
  • 21.5. Build your own client
• 22. 3rd Party Integration
  • 22.1. Symantec SSL Visibility (BlueCoat)
• 23. Man Pages
  • 23.1. Suricata
  • 23.2. Suricata Socket Control
  • 23.3. Suricata Control
  • 23.4. Suricata Control Filestore
• 24. Acknowledgements
• 25. Licenses
  • 25.1. GNU General Public License
  • 25.2. Creative Commons Attribution-NonCommercial 4.0 International Public License
  • 25.3. Suricata Source Code
  • 25.4. Suricata Documentation