<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
</head><body><p style="color: rgb(0, 0, 128); font-family: arial,helvetica,sans-serif; font-size: 12pt;">You can certainly do that.<br></p><p style="color: rgb(0, 0, 128); font-family: arial,helvetica,sans-serif; font-size: 12pt;">Setup Suricata to do IPS not IDS, with NFQ and use iptables to push all/selective eth0/INPUT traffic to Suricata.<br></p><p style="color: rgb(0, 0, 128); font-family: arial,helvetica,sans-serif; font-size: 12pt;">You can then use any rules and set action to drop on them as required.<br></p><p style="color: rgb(0, 0, 128); font-family: arial,helvetica,sans-serif; font-size: 12pt;">Amar<br></p><p style="color: rgb(0, 0, 128); font-family: arial,helvetica,sans-serif; font-size: 12pt;"><br></p><blockquote type="cite">On December 23, 2017 at 2:49 PM Blason R <blason16@gmail.com> wrote:<br><br><div dir="ltr">Hi Guys,<div><br></div><div>Can someone please help me with this idea? I have DNS server set up on CentOS 7.4 which is acting as a sinkhole server where I have installed ELK stack as well. </div><div><br></div><div>Since this named/bind is acting as a sinkhole it is already blocking malicious known domains collected from OSINT.</div><div><br></div><div>My idea here is; if it is possible to integrate/install suricata IPS on same server and monitor on eth0? And since that is a DNS server can I block the response IP addresses received which may be malicious.</div><div><br></div><div>for example</div><div><br></div><div><a href="http://www.looks-genuine.com">www.looks-genuine.com</a> = Domain may not be listed in blacklist</div><div>15.16.1.18 ==> But IP is malicious hence either block it or alert it</div><div><br></div><div>Plus detect the advance level of DNS attacks? like iodine, DNS beacon channels queries? </div><div><br></div><div>Please suggest; can this be achieved? </div></div>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br><br>Conference: https://suricon.net<br>Trainings: https://suricata-ids.org/training/</blockquote></body></html>