Using SuricataLog to analyze your events

This is condensed storyline from SuriCon 2024 (pre-SuriCon).

Link to YouTube presentation will be shared soon!

Installing Suricata

sudo dnf install dnf-plugins-core
sudo dnf copr enable @oisf/suricata-7.0
sudo dnf install suricata
sudo vi /etc/sysconfig/suricata (setup network interfaces, etc)
sudo suricata-update && sudo suricata-update update-sources
for source in et/open osif/trafficid ptresearch/attackdetection tgreen/hunting malsilo/win-malware; do sudo suricata-update enable-source $source; done
sudo sudo suricata-update
sudo suricata-update list-enabled-sources
Sudo vi /etc/suricata/suricata.yaml # Bare minimum edit HOME_NET and make sure ‘payload: yes’
sudo systemctl enable suricata.service –now
sudo systemctl enable suricata-update.service –now
dnf -y install wireshark wireshark-cli # Yeah, it is super useful.

Installing SuricataLogs

sudo python3 -m venv /usr/local/venvs/suricatalog && 
sudo -i # Yeah, let’s install this for all the users
. /usr/local/venvs/suricatalog/bin/activate
pip install –upgrade pip
pip install suricatalog # Watch the magic unfold!!!
eve_log --help

Make Suricata works

Use -l to save eve.json to a separate directory, for now

root@raspberypi1:/mnt/data/malware# sudo suricata -r /mnt/data/malware/2022-02-08-Emotet-epoch4-infection-start-and-spambot-traffic.pcap -k none --runmode autofp -c /etc/suricata/suricata.yaml -l /mnt/data/malware/
i: suricata: This is Suricata version 7.0.6 RELEASE running in USER mode
i: threads: Threads created -> RX: 1 W: 4 FM: 1 FR: 1   Engine started.
i: suricata: Signal Received.  Stopping engine.
i: pcap: read 1 file, 44949 packets, 32163467 bytes

There is a lot of content

jq 'select(.event_type=="alert")' /mnt/data/malware/eve.json

Running SuricataLog

eve_log /mnt/data/walmware/eve.json # eve.json as a nice table
eve_json --nxdomain /mnt/data/walmware/eve.json # DNS domains involved, queries
eve_json --useragent /mnt/data/walmware/eve.json # Any browser user agent?
eve_json --flow /mnt/data/walmware/eve-2.json # Packets by traffic

Getting the source code

sudo dnf install -y git
git clone https://github.com/josevnz/SuricataLog
python3 -m venv ~/venv/suricatalog
. ~/venv/suricatalog/bin/activate
pip install –upgrade pip && pip install build
python3 -m build . # Get an wheelhouse
pip install --editable . # To really play
python3 -m unittest discover -s test -t test # Run unit tests

Debugging a textualize application

On first terminal:

. ~/venv/suricatalog/bin/activate
pip install textual-dev==1.3.0
textual console

And on another:

. ~/venv/suricatalog/bin/activate
textual run --dev --command eve_json --payload test/eve.json