Скачать или смотреть Project 31 - Configuring Suricata IDS/IPS for Cyber Defense

Commands Used/Step Taken (in the order they appear in the video):

Suricata - an open-source network intrusion detection system (IDS) and intrusion prevention system (IPS) that provides high-performance network traffic analysis and security monitoring.

1. sudo apt-get install -y software-properties-common (to ensure that we have the necessary package for managing software repositories installed)

2. sudo add-apt-repository ppa:oisf/suricata-stable (to add the Suricata stable repository to your system)

3. sudo apt-get update -y (to update all of our installed repositories)

4. sudo apt-get install suricata -y (to install Suricata)

5. sudo nano /etc/suricata/suricata.yaml (to edit main Suricata configuration file to view the default IP range)

6. ^ Suricata uses the range of IP addresses defined in home_net to filter out traffic that originates from our internal network, focusing its analysis on external traffic that may pose a threat)

7. Open another terminal and ip a (to find the subnet range which we need for monitoring,)

8. Back in the configuration file terminal, replace the IP range in home_net with 192.168.1.100/24

9. Scroll down to -interface: and replace eth0 with en32

10. sudo suricata-update (to update Suricata's rule sets)

11. sudo suricata -T -c /etc/suricata/suricata.yaml (to test the configuration)

12. sudo systemctl restart suricata.service (To restart Suricata to ensure that configuration changes take effect)

13. sudo systemctl enable suricata.service (To start up Suricata and ensure continuous monitoring functionality will begin upon system boot)