<div dir="ltr">Hmm, don't want to start Suricata in IPS mode, as it's configured to sniff traffic through a tap and should really be running as an IDS.<div>Not sure if the triggering of alerts would depend on mode though, but I might be wrong..</div></div><br><div class="gmail_quote"><div dir="ltr">On Mon, Sep 24, 2018 at 3:41 PM Albert Whale <<a href="mailto:Albert.Whale@it-security-inc.com">Albert.Whale@it-security-inc.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<p>So what happens if you start Suricata in IPS Mode?<br>
</p>
<br>
<div class="m_-4450235794366213523moz-cite-prefix">On 9/24/18 2:17 PM, fatema bannatwala
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">Hi Albert,
<div><br>
</div>
<div>I am running Suricata in IDS mode.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Fatema.</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Mon, Sep 24, 2018 at 2:11 PM Albert E Whale
<<a href="mailto:Albert.Whale@it-security-inc.com" target="_blank">Albert.Whale@it-security-inc.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Fatema,<br>
<br>
I’m curious, are running Suricata in IDS or IPS mode?<br>
<br>
I am experiencing significant issues with IPS on a small home
office environment.<br>
<br>
Sent from my iPhone<br>
<br>
> On Sep 24, 2018, at 1:26 PM, fatema bannatwala <<a href="mailto:fatema.bannatwala@gmail.com" target="_blank">fatema.bannatwala@gmail.com</a>>
wrote:<br>
> <br>
> Hi All,<br>
> <br>
> I am working on getting Suricata up and running with same
rulesets as we have for snort.<br>
> Hence running Suricata with both VRT open source free
ruleset from Cisco as well as with ET-PRO rule sets from
Proofpoint for suricatav4.0.4.<br>
> <br>
> When I start Suricata it gives some errors for around 200
VRT rules concerning Invalid_Signature/Unknown_Keyword, which
make sense as they are not designed to be run with Suricata.
But Suricata starts up correctly and works fine inspite of
those rule errors.<br>
> <br>
> My concern is, the number of unique alerts that get
triggered in Snort are more than the unique alerts triggered
in Suricata, even though both are getting same traffic flow.
The difference is huge, i.e. 241 unique Snort alerts compared
to only 94 unique alerts in Suricata.<br>
> <br>
> When did an analysis, the difference is between ETPRO
alerts as well as VRT alerts that are triggered in both. And
confirmed that the sids that are getting triggered in snort
are also enabled in suricata, but still no suricata alerts for
those sids.<br>
> <br>
> Hence, my question is why there is this discrepancy in
the alerts that get triggered in snort and not in suricata
even when they both are seeing the same traffic and have same
sids enabled?<br>
> <br>
> P.S My initial thought was, either it's because of
capture loss in suricata (which is <0.1%), or maybe because
of some of those incompatible VRT alerts that are enabled in
Suricata, and it is not able to work correctly because of
those.<br>
> <br>
> Has anyone tried this kind on config before?<br>
> <br>
> Thanks,<br>
> Fatema.<br>
> <br>
> <br>
> _______________________________________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a>
| Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> <br>
> Conference: <a href="https://suricon.net" rel="noreferrer" target="_blank">https://suricon.net</a><br>
> Trainings: <a href="https://suricata-ids.org/training/" rel="noreferrer" target="_blank">https://suricata-ids.org/training/</a><br>
<br>
</blockquote>
</div>
</blockquote>
<br>
<div class="m_-4450235794366213523moz-signature">-- <br>
--<br>
<br>
Albert E. Whale, CEH CHS CISA CISSP<br>
<b>President - Chief Security Officer</b><br>
<a href="http://www.IT-Security-inc.com" target="_blank">IT Security, Inc.</a> - A
Service Disabled Veteran Owned Company - (<b>SDVOSB</b>)<br>
<b>HUBZone Certified</b><br>
<a href="https://www.linkedin.com/in/albertwhale" target="_blank">LinkedIn</a>
Profile<br>
<br>
<br>
Phone: 412-515-3010 | Email: <a class="m_-4450235794366213523moz-txt-link-abbreviated" href="mailto:Albert.Whale@IT-Security-inc.com" target="_blank">Albert.Whale@IT-Security-inc.com</a><br>
Cell: 412-889-6870<br>
<br>
</div>
</div>
</blockquote></div>