Why Use Suricata for Network Monitoring

Suricata is known for its speed, accuracy, and versatility. It supports multi-threading, is compatible with popular rule sets like Emerging Threats, and can output data in multiple formats including JSON for easy integration with SIEM platforms.

By choosing Suricata for your monitoring system, you're gaining a flexible, scalable solution that adapts to evolving cybersecurity needs.

Step-by-Step Guide to Set Up Suricata Monitoring System

1. Prerequisites and Environment Setup

Before installing Suricata, ensure your system meets the following requirements:

  • Linux distribution (Ubuntu, Debian, CentOS)
  • Root or sudo privileges
  • Internet access for downloading packages
  • Network interface set in promiscuous mode for packet capturing

We’ll use Ubuntu in this example, but the process is similar for other distros with slight variations in package management.

2. Installing Suricata on Linux

On Ubuntu/Debian

sudo apt update
sudo apt install suricata -y

On CentOS/RHEL

sudo yum install epel-release -y
sudo yum install suricata -y

You can confirm the version with:

suricata --build-info

3. Configuring Suricata

Suricata’s configuration file is located at:

/etc/suricata/suricata.yaml

Edit with:

sudo nano /etc/suricata/suricata.yaml

Important Config Sections:

af-packet or pcap: Define your network interface:

af-packet:
  - interface: eth0

rule-files: Make sure it points to your rule set (e.g., suricata.rules).

outputs: Enable logs like fast.log and eve.json:

outputs:
  - fast:
      enabled: yes
  - eve-log:
      enabled: yes
      types:
        - alert
        - dns
        - http

4. Enable Promiscuous Mode

sudo ip link set eth0 promisc on
ip link show eth0

5. Running Suricata

Run manually:

sudo suricata -c /etc/suricata/suricata.yaml -i eth0

Run as a service:

sudo systemctl enable suricata
sudo systemctl start suricata
sudo systemctl status suricata

Monitoring and Analyzing Suricata Logs

Logs are located at:

/var/log/suricata/

Key Log Files:

  • fast.log: Quick alerts overview
  • eve.json: Detailed JSON logs
  • stats.log: Performance metrics
tail -f /var/log/suricata/fast.log
jq . /var/log/suricata/eve.json

Testing Suricata’s Functionality

curl http://testmyids.com

This will trigger a safe IDS alert in your logs.

Updating and Managing Suricata Rules

sudo apt install python3-pip -y
pip3 install --upgrade suricata-update
sudo suricata-update
sudo suricata-update enable-source oisf/trafficid
sudo suricata-update
sudo systemctl restart suricata

Integrating Suricata with Visualization Tools

1. ELK Stack

  • Logstash: parses eve.json
  • Elasticsearch: stores data
  • Kibana: visualizes alerts

2. Wazuh + Suricata

Wazuh offers native Suricata integration with SIEM and correlation capabilities.

Automating Suricata with Systemd and Cron

sudo systemctl enable suricata

Automate rule updates:

sudo crontab -e

0 2 * * * /usr/local/bin/suricata-update && systemctl restart suricata

Hardening Your Monitoring System

  • Restrict Suricata to specific interfaces
  • Secure log directories
  • Monitor resource usage
  • Use dedicated NICs in high-traffic setups

Final Thought

Deploying a Suricata monitoring system empowers your infrastructure with real-time visibility, alerting, and actionable insights. With rule-based detection, packet inspection, and support for powerful integrations like ELK, Suricata becomes a crucial asset in modern network defense.

Whether you're running a small home network or a large enterprise, setting up Suricata offers a strong line of defense. By following this guide and continuously updating your rules, you’ll be well-positioned to detect, respond to, and prevent potential intrusions.

Watch video gide: Suricata monitoring system