Lesson 4.13: IDS alerts with Suricata
An intrusion detection system (IDS) inspects traffic against signatures, rules that describe known bad patterns in packets, and raises alerts. Suricata, one of the most used open-source IDS engines, writes everything as JSON in eve.json: alerts and the protocol details of the same flows. In the lab you rank a day's alerts by severity, read the custom rule behind the most serious one, connect the alert to the HTTP request that triggered it, and check how a noisy but harmless signature was suppressed for one server only.
17 min
You will learn to
- Explain signature-based IDS
- Read Suricata's eve.json
- Rank alerts by severity and signature
- Read a Suricata rule
- Link an alert to its flow and suppress noise narrowly
Key terms
- IDS / IPS
- Intrusion detection system (alerts) / intrusion prevention system (also blocks).
- Signature / rule
- A pattern describing malicious or suspicious traffic.
- eve.json
- Suricata's JSON log: alerts and protocol records (dns, http, tls, flow, fileinfo) sharing a flow_id.
- sid
- Signature ID, unique per rule. Local rules conventionally use 1000000–1999999 or another private range.
- Suppression / threshold
- Suricata settings to silence or rate-limit a signature, ideally for a specific source or destination only.
← Path traversal and command injection · All lessons · Certificates and PKI →