6 / 36 chapters
    DocumentationDeployment

    06

    Suricata IDS Installation

    Suricata IDS

    Deploy Suricata IDS on a gateway server. Suricata passively monitors network traffic (AF_PACKET) and generates events (alerts, DNS, TLS, HTTP, flows) into EVE JSON, from where Elastic Agent sends them to Elasticsearch and displays them in the IDS.

    IDS — Suricata alerts
    1

    Prerequisites

    OS: Ubuntu 22.04+ • Access: root

    The gateway must have Elastic Agent installed with the linux-web policy (includes Suricata integration). See Agent installation → Linux.

    2

    Script installation

    The script installs Suricata, configures the interface, HOME_NET, community-id, and downloads rules (ET Open, ~48k signatures).

    bash
    curl -sL -O https://repo.net-service.io/flowpro/install-suricata.sh
chmod +x install-suricata.sh
sudo ./install-suricata.sh --interface eth0

    Custom HOME_NET:

    bash
    sudo ./install-suricata.sh \
  --interface eth0 \
  --home-net "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"

    Parameters: --interface (WAN interface), --home-net (CIDR blocks separated by comma), --help

    3

    Verification

    bash
    sudo systemctl status suricata
tail -20 /var/log/suricata/suricata.log | grep "signatures processed"
tail -1 /var/log/suricata/eve.json | python3 -m json.tool
sudo elastic-agent status
    After restart, verify that the log shows "XX signatures processed" with a non-zero count (~49k with ET Open rules). If 0 signatures — rules were not loaded. Check that suricata.yaml default-rule-path matches the path where suricata-update saves rules (/var/lib/suricata/rules/). See Troubleshooting below.
    Data will appear in the IDS module and Log Explorer within 1-2 minutes. The stats type is generated immediately, others when matching traffic occurs.