<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
</head><body><p class="default-style" style="font-size:12pt;font-family:arial, helvetica, sans-serif;color:#000080;">None I can think of specifically for a general setup.<br></p><p class="default-style" style="font-size:12pt;font-family:arial, helvetica, sans-serif;color:#000080;">I will be more than happy to help you go through all that you need...perhaps outside of the entire group<br>regards<br></p><p class="default-style" style="font-size:12pt;font-family:arial, helvetica, sans-serif;color:#000080;">Amar<br></p><blockquote type="cite">On December 28, 2017 at 10:06 AM Blason R <<a href="mailto:blason16@gmail.com">blason16@gmail.com</a>> wrote:<br><br><br>Thanks for idea need to work out on this. Any reference document would really appreciate.<br><br><br>On Wed, Dec 27, 2017 at 8:07 PM, Amar Rathore - CounterSnipe Systems <<a href="mailto:amar@countersnipe.com">amar@countersnipe.com</a>> wrote:<blockquote type="cite">You can certainly do that.<br><br><br>Setup Suricata to do IPS not IDS, with NFQ and use iptables to push all/selective eth0/INPUT traffic to Suricata.<br><br><br>You can then use any rules and set action to drop on them as required.<br><br><br>Amar<blockquote type="cite">On December 23, 2017 at 2:49 PM Blason R <<a href="mailto:blason16@gmail.com">blason16@gmail.com</a>> wrote:<br><br><br>Hi Guys,<br> <br>Can someone please help me with this idea? I have DNS server set up on CentOS 7.4 which is acting as a sinkhole server where I have installed ELK stack as well. <br> <br>Since this named/bind is acting as a sinkhole it is already blocking malicious known domains collected from OSINT.<br> <br>My idea here is; if it is possible to integrate/install suricata IPS on same server and monitor on eth0? And since that is a DNS server can I block the response IP addresses received which may be malicious.<br> <br>for example<br> <br>[www.looks-genuine.com](<a href="http://www.looks-genuine.com" target="_blank" rel="noopener noreferrer">http://www.looks-genuine.com</a>) = Domain may not be listed in blacklist<br>15.16.1.18 ==> But IP is malicious hence either block it or alert it<br> <br>Plus detect the advance level of DNS attacks? like iodine, DNS beacon channels queries? <br> <br>Please suggest; can this be achieved? <br><br><br>_______________________________________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org" target="_blank" rel="noopener noreferrer">http://suricata-ids.org</a> | Support: [<a href="http://suricata-ids.org/support/](http://suricata-ids.org/support/" target="_blank" rel="noopener noreferrer">http://suricata-ids.org/support/](http://suricata-ids.org/support/</a>)<br>List: [<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users](https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank" rel="noopener noreferrer">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users](https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>)<br><br>Conference: <a href="https://suricon.net" target="_blank" rel="noopener noreferrer">https://suricon.net</a><br>Trainings: [<a href="https://suricata-ids.org/training/](https://suricata-ids.org/training/" target="_blank" rel="noopener noreferrer">https://suricata-ids.org/training/](https://suricata-ids.org/training/</a>)</blockquote></blockquote></blockquote></body></html>