Hacking Trainer AcademyAmeerpet · Hyderabad
+91 86868 92922 Book free classes

SOC and blue team

Suricata for Beginners: Install, Rules and Alerts

· 2 min read · By Thimmagurudu Bathini, Lead Trainer and Curriculum Designer

Suricata is a free intrusion detection system (IDS). It watches network traffic, compares it with rules and writes alerts. If the idea is new, read firewalls, IDS and IPS explained first. This guide builds a small lab on a Debian or Ubuntu virtual machine you own.

Install and Update Rules

  • sudo apt install suricata
  • sudo suricata-update downloads the Emerging Threats Open rule set.
  • sudo suricata -T -c /etc/suricata/suricata.yaml -v tests the configuration.

Run It

  • Set the interface in /etc/suricata/suricata.yaml (the af-packet section), or pass it on the command line.
  • sudo suricata -c /etc/suricata/suricata.yaml -i eth0

Leave it running in one terminal. Use a second VM to generate traffic.

Read the Alerts

  • /var/log/suricata/fast.log has one readable line per alert.
  • /var/log/suricata/eve.json has full detail in JSON, which tools such as Splunk and Wazuh can read; see Splunk vs Wazuh.
  • tail -f /var/log/suricata/fast.log follows new alerts as they appear.

Write a Simple Rule

Add a rule to a local rule file listed under rule-files in the configuration. This one alerts when an HTTP request carries a user agent you choose:

  • alert http any any -> any any (msg:"LAB test user agent"; http.user_agent; content:"labtest"; sid:1000001; rev:1;)

Reload Suricata, then from another VM run curl -A labtest http://192.168.56.20/. The alert should appear in fast.log. Custom rule ids start at 1000000 so they do not clash with downloaded rules.

Tune and Learn

Run a scan from another VM (Nmap for beginners) and see which rules fire. Real teams spend much of their time tuning noisy rules. Network monitoring and perimeter defense are covered in the CND syllabus and the SOC analyst guide.

Sources and Further Reading

Want to build and attack a monitored lab with a trainer? Book free trial classes. Contact us or call +91 86868 92922.

Courses Mentioned in This Guide

Beginner to intermediate · EC-Council certification

Certified Network Defender (CND)

Defend the network. Monitor, detect and respond to threats.

₹34,000 + GST

  • Network security
  • Threat detection
  • Monitoring tools
  • Incident response
View the certification →
Advanced · EC-Council certification

Certified SOC Analyst (CSA v2)

Run the SOC. Hunt threats and manage security incidents.

₹34,000 + GST

  • SOC operations
  • Threat hunting
  • SIEM management
  • Orchestration
View the certification →
Beginner to intermediate · Course · 6 weeks, 90 hours

SOC Analyst and DFIR

The core concepts of EC-Council's CCT, CSA, ECIH and CHFI, taught hands-on with Splunk, Wazuh and forensics tools, in six weeks.

₹20,000 + GST · 6 weeks

  • CCT, CSA, ECIH, CHFI core concepts
  • Splunk and Sentinel
  • Phishing triage and hunting
  • Incident handling
  • Forensics and malware analysis
View the course →

More Guides

SOC and blue team · 3 min read

Firewalls, IDS and IPS Explained for Beginners

What a firewall, an IDS and an IPS each do, how they differ, where they sit on a network, how to try a firewall in a lab, and what defenders still miss.

Read the guide →
SOC and blue team · 2 min read

Tcpdump Command for Beginners: Capture and Filter Traffic

tcpdump command cheat sheet: capture on an interface, filter by host and port, spot SYN packets, save to a file and open it in Wireshark.

Read the guide →
Certification · 3 min read

CND Certification: Exam Format, Eligibility and 20 Modules

What the EC-Council CND exam looks like: 100 questions in 4 hours, the 20 modules, who can start, how much is hands-on and what it leads to.

Read the guide →
Certification · 2 min read

How to Prepare for the CND Exam: A 6-Week Study Plan

A 6-week CND study plan: modules grouped by week, lab practice with firewalls, logs and traffic, timed question drills and exam-day pacing.

Read the guide →

Start Your Cyber Security Career

Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.

Book Free Trial Classes

By submitting, you agree that Hacking Trainer Academy may contact you about courses by phone, WhatsApp or email. See our privacy notice and refund policy.

WhatsApp