Lion Cipher Lab
Set up Suricata to watch your own network (open-source IDS)
- SOC Analyst / Blue Team
- Beginner
- ~45 min
- Free · no account required
Why it matters
Reading packets by hand tells you what happened; it does not scale to watching a network around the clock. An intrusion detection system does that watching for you: it inspects the traffic crossing an interface and raises an alert when something matches a pattern of known-bad activity. Suricata is the leading open-source IDS/IPS — a fast, multi-threaded engine that inspects traffic against thousands of community rules and can also run inline to block, not just warn. It is free, it is what a great many real security teams actually run, and paired with the free Emerging Threats Open ruleset it…
What you'll learn
- what an IDS/IPS is
- installing Suricata
- choosing a capture interface (suricata -i)
- loading the free ET Open ruleset with suricata-update
- generating safe test traffic
- reading eve.json alerts
- signature vs anomaly detection
Steps in this lab
- First: watch only your own network
- What an IDS is — and signature vs anomaly detection
- Install Suricata
- Point Suricata at your own interface
- Load the free ET Open ruleset
- Start Suricata with rules, then make a little safe test traffic
- Read the alerts in eve.json
- What you built, and why standing up the tool matters