Month: December 2023

Suricata 7 Features You Need to Know

I am going to update you about much-anticipated release of Suricata 7, marking a significant milestone in the evolution of this high-performance Network Threat Detection, IDS, IPS, and Network Security Monitoring engine. The development team at the Open Information Security Foundation (OISF) and the vibrant community have worked tirelessly to bring forth a host of new features, performance improvements, and security enhancements.

Main Features

1. Enhanced Packet Processing with DPDK IDS/IPS Support

  • Suricata 7 introduces DPDK IDS/IPS 60 support for primary mode, enhancing packet processing capabilities and ensuring optimal performance.

2. Advanced AF_XDP IDS Support

  • Richard McConnell at Rapid7 contributes AF_XDP IDS 30 support, further expanding the engine’s capabilities for efficient and high-speed packet processing.

3. Extended HTTP/HTTP2 Inspection

  • New keywords for header inspection in HTTP/HTTP2 protocols provide enhanced visibility and control over web traffic.

4. TLS Improvements

  • Suricata 7 brings client certificate logging and detection in TLS, bolstering security measures for encrypted communications.

5. Bittorrent Parser

  • Aaron Bungay contributes a Bittorrent parser, adding support for this popular peer-to-peer file-sharing protocol.

6. Improved IPS Default DROP Behavior

  • Exception policies now default to DROP behavior, enhancing the default security stance for intrusion prevention.

7. EVE Documentation and Validation

  • Event (EVE) logging is documented and validated with a JSON schema, ensuring comprehensive and standardized event reporting.

8. Performance Improvements Across the Board

  • Suricata 7 boasts numerous performance improvements, including optimizations in file data processing, SMB, hash calculation, and flow management.

9. Stream Buffer Efficiency

  • The stream buffer, utilized by the stream engine, file tracking, and more, is now more memory-efficient, contributing to overall system optimization.

Secure Deployment and Security Enhancements

1. Linux Landlock Support

  • Eric Leblond introduces Linux Landlock support, enhancing the security posture of Suricata deployments.

2. Secure Settings by Default

  • Suricata 7 defaults to secure settings for Datasets and Lua, ensuring a robust and secure configuration out of the box.

3. Network Service Header

  • The addition of Network Service Header enhances network service identification, contributing to a more secure network environment.

Protocol and Rules Updates

1. Expanded Protocol Support

  • Suricata 7 adds support for QUICv1, GQUIC, PostgreSQL, VN-Tag, and IKEv1, among others, expanding the range of supported protocols.

2. Rule Keywords and Rule Set Updates

  • New rule keywords for DHCP, Kerberos, SNMP, TLS, QUIC, and experimental class of keywords through “frames API” have been introduced.

3. IPS Exception Policies

  • Exception policies have been added to provide better control over packet handling, especially in conditions like hitting memory caps.

Output and Dev Corner

1. Flexible Packet Capture

  • Conditional packet capture allows packets to be written to disk only after an alert has been triggered, providing flexibility in capturing relevant data.

2. Enhanced Logging and Debugging

  • The new “stream” EVE output type facilitates debugging of the stream engine, and log engine verdicts on rejected/dropped/passed packets for improved visibility.

3. Development Corner Updates

  • Suricata 7 includes total code changes, stricter C compiler flags, expanded CI, upgraded Rust parsers, and more, demonstrating a commitment to continuous improvement.

Upgrade Notes

1. Pcre2 Integration

  • Suricata 7.0 now uses pcre2 instead of pcre1 for regular expression matching.

2. Minimum Supported Rust Version

  • The MSRV (minimum supported Rust version) has been updated to 1.63.0 from 1.41.1 minimum in Suricata 6.0.

3. Library Updates

  • Support for Prelude (libprelude) has been removed, and Suricata 7.0 requires and bundles libhtp 0.5.45.

For more detailed information on upgrading from Suricata 6 to 7, refer to the official documentation [here](https://github.com/OISF/suricata/blob/master/Upgrading from 6 to 7).

In conclusion, Suricata 7 represents a substantial step forward in network security, with its comprehensive feature set, improved performance, and heightened security measures. The development team and the community continue to demonstrate their dedication to providing a robust and cutting-edge open-source security solution.

To experience the power of Suricata 7 firsthand, download the latest release here.

Suricata rules install karne ka tarika

Suricata rules ko install karne ke liye, neeche diye gaye kuch steps hain. Yeh steps Kali/Debian/Ubuntu Linux distribution ke liye hain. Agar aapka distribution alag hai, toh aapko package manager aur command mein thoda sa badlao karna hoga.

Suricata Install Kare:

1. Kali/Debian/Ubuntu Opreating Sysetm main Suricata install karne ke liye, terminal mein ye commands type karein:

sudo apt update

sudo apt install suricata

Installation process complete hone tak wait karein.

2. Suricata Rules Download Kare:

Suricata rules ko download karne ke liye aap Emerging Threats ya Snort Community ke official websites se rules ko obtain kar sakte hain. Yeh rules Suricata ke liye compatible hote hain. Ek popular source hai

Emerging Threats Open Rules:

sudo suricata-update update-sources

sudo suricata-update enable-source et/open

sudo suricata-update

Isse Suricata rules updated ho jayenge.

3. Suricata Configuration File Ko Update Kare:

Suricata ko aapke system ke requirements ke Mutabiq configure karna important hai. Configuration file Zada tar /etc/suricata/suricata.yaml mein hoti hai. Aap is file ko text editor se edit kar sakte hain, jaise ki nano:

sudo nano /etc/suricata/suricata.yaml

File mein default-rule-path ya rule-files section ko check karein aur yeh confirm karein ki yeh rules ke liye sahi path ko point kar rahe hain.

4. Suricata Restart Kare:

Configuration changes ke baad Suricata ko restart karein:

sudo service suricata restart
  1. Restart ke baad, Suricata rules apply hokar traffic monitor karna shuru karega.

Yeh tarike aapko Suricata rules ko install karne mein madad karenge. Dhyan rahe ke security ke liye suricata properly configured aur regularly updated rehna chahiye.

Powered by WordPress & Theme by Anders Norén