What is Suricata?
Suricata is a high-performance IDS/IPS and network security monitor. It matches traffic against rules such as the free ET Open ruleset and writes alerts and protocol metadata to eve.json.
1 Rules
A rule says: action, protocol, direction, and what to look for (content, headers, TLS SNI…), plus a unique sid.
2 IDS vs IPS
IDS mode alerts; IPS mode sits inline and can drop matching traffic.
3 eve.json
Structured JSON output (alerts, DNS, HTTP, TLS, flows) that ships easily to a SIEM.
The scenario: Catch the beacon with your own rule
The capture from WS-077 is in capture.pcap. Run Suricata with the ET Open rules, review the alerts, then write a custom rule that reliably detects the /api/v2/beacon C2 traffic and prove it fires.
Run this lab live in the platform
A simulated terminal with 5 objectives, hints and scenario questions. Included with NERvE Pro.
Open the Suricata labStep-by-step: Suricata commands used in this lab
1Run Suricata on the capture with the default rules
-r reads a pcap, -l sets the log folder.
suricata -r capture.pcap -l logs/2Read the quick alert log
fast.log has one line per alert.
cat logs/fast.log3Count alerts by signature from eve.json
jq: select alerts, print the signature, count.
jq -r 'select(.event_type=="alert") | .alert.signature' logs/eve.json | sort | uniq -c4Write a custom rule for the beacon
Append an http rule matching the URI to local.rules.
echo 'alert http any any -> any any (msg:"NERvE C2 beacon"; http.uri; content:"/api/v2/beacon"; sid:1000001; rev:1;)' >> local.rules5Re-run with your rule and confirm it fires
-S loads your rules file.
suricata -r capture.pcap -S local.rules -l logs/Key takeaways
- Rules = action + protocol + direction + match options + sid.
- Test every rule against real captures before deploying.
- eve.json is the format to ship to your SIEM.
- Combine signature IDS with behavioural monitoring (Zeek) for coverage.
Install Suricata and practise for real
sudo add-apt-repository ppa:oisf/suricata-stable && sudo apt install suricata && sudo suricata-updatesuricata-update downloads the free ET Open rules. Run with -r on sample pcaps first. Only scan or test systems you own or are explicitly authorised to assess. Official site: suricata.io · Licence: GPLv2.
Scenario questions
Why use sid 1000001 or higher for your own rules?
Answer: IDs below 1,000,000 are reserved for official/distributed rulesets. Local rules use sids from 1,000,000 upward to avoid clashing with published rulesets.
What would make Suricata block the beacon instead of alerting?
Answer: Run inline in IPS mode and use the drop action. In IPS (inline) mode, 'drop' rules block matching traffic.
Why is a precise custom rule better than generic alerts here?
Answer: It detects every beacon from this C2 family with fewer false positives. Specific detections give high-fidelity alerts you can act on automatically.
More open-source tool labs
Nmap
Discover hosts, open ports and services on networks you're authorised to assess.
Wireshark / tshark
See exactly what's crossing the wire and spot malware calling home.
Zeek
Turn raw traffic into rich, searchable logs for threat hunting.
Wazuh
An open-source SIEM and XDR: collect logs, detect attacks, respond automatically.
Sigma
Write a detection once, run it in any SIEM.
YARA
Describe malware by its patterns and hunt for it across files.