Lion Cipher Lab
Make Suricata useful: manage rulesets, read EVE JSON, and tune out the noise
- SOC Analyst / Blue Team
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Installing an IDS is the easy half. The half that decides whether it was worth doing is what happens over the next two weeks, when the sensor is producing tens of thousands of records a day and one chatty policy rule is generating 90% of them. This is the exact point where most deployments quietly die: analysts learn that the console is noise, they stop reading it, and the organisation now has a detection capability of zero while believing it has one — which is strictly worse than having no sensor at all, because at least an absent sensor doesn't create false confidence. The skills that…
What you'll learn
- managing Suricata rulesets with suricata-update (sources, enable-source, update)
- understanding what a rule source is and where merged rules land on disk
- validating a config safely with suricata -T before restarting a sensor
- reloading rules live without dropping packets (USR2 / suricatasc)
- reading EVE JSON: event types and the anatomy of an alert record
- querying eve.json with jq — top signatures, per-host alerts, distinct destinations
- hunting in Suricata's non-alert protocol logs (dns, tls/SNI/JA3, http)
- tuning noise correctly with threshold.config: suppress, threshold, rate_filter
- knowing when to disable a rule outright with disable.conf — and when not to
- enabling file extraction and fileinfo hashing, and handing hashes to YARA
Steps in this lab
- Where Part 1 left you, and the problem nobody warns you about
- WHEN Suricata is the right tool — versus Zeek, versus Snort
- Rule sources: what they are, and why the default is not enough
- Test before you trust: suricata -T
- Reload rules live, without dropping the sensor
- EVE JSON: Suricata's real output, and the event types inside it
- Anatomy of an alert record — every field that matters
- The jq drills — the four queries you will use forever
- The non-alert goldmine: hunting in dns, tls and http records
- WHY an untuned IDS is worse than no IDS at all
- Find your noisiest signature — then INVESTIGATE it before touching it
- Tune it properly with threshold.config — suppress, threshold, rate_filter
- When a whole rule has to go: disable.conf and enable.conf
- Do it better: measure the change, and put your tuning in version control
- File extraction and fileinfo hashing — the handoff to YARA
- What you actually learned, and the judgment to carry out of here