This post will demonstrate creating a custom rule in Suricata to generate an alert. In the /etc/suricata/rules directory I made a new rules file called custom.rules: For Suricata to run this rule, the new rule file needs to be added…
This post will show how to make a daemon with Python that will leverage Suricata alerts to block IP addresses. Here is a look at the full code for the daemon, called ‘alert_daemon.py’: Now I will break down each section.…
This is the final part for building a custom firewall with the utilization of IP Reputation within Suricata. The first step to take is to go into ‘suricata.yaml’, go to the IP Reputation section, and remove the comment tags from…