<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Kaushal,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Wicar.org has some exploits which will trigger ET signatures, along with the Testmyids site that Travis mentioned. You can use that to trigger events on your IDS to make sure that it is working as expected.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best Regards,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#1D0E00">Brad Woodberg
</span></b><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#1D0E00">l<b>
</b>Group Product Manager - Emerging Threats, TAP Campaigns</span><span style="font-size:16.0pt;font-family:"Times New Roman",serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Proofpoint, Inc.</span><span style="font-size:12.0pt;font-family:"MS Mincho"">
<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">E:
<a href="mailto:bwoodberg@proofpoint.com"><span style="color:#0563C1">bwoodberg@proofpoint.com</span></a><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><a href="http://www.proofpoint.com/"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;text-decoration:none"><img border="0" width="150" height="33" style="width:1.5625in;height:.3437in" id="Picture_x0020_1" src="cid:image001.png@01D4CF39.70D12FF0" alt="id:image001.png@01D285E1.0101B2B0"></span></a><span style="font-size:16.0pt;font-family:"Times New Roman",serif"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#0F6B96">threat protection l compliance l archiving & governance l secure communication</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Kaushal Shriyan <kaushalshriyan@gmail.com><br>
<b>Date: </b>Friday, February 22, 2019 at 9:57 PM<br>
<b>To: </b>Brad Woodberg <bwoodberg@proofpoint.com><br>
<b>Cc: </b>"oisf-users@lists.openinfosecfoundation.org" <oisf-users@lists.openinfosecfoundation.org><br>
<b>Subject: </b>Re: [Oisf-users] Test IDS/IPS and NSM functionality of Suricata<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Sat, Feb 23, 2019 at 12:03 AM Brad Woodberg <<a href="mailto:bwoodberg@proofpoint.com">bwoodberg@proofpoint.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hi Kaushal,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">If you’re using the Emerging Threats ruleset
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__wicar.org&d=DwMFaQ&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjhg&r=rOVyB9ixExmyqAgEyDnrUtIQ2jlUiP4p_9Yb9cbBi4A&m=JEDciNqScL2NUbSjQnDJp13bIWL57MsiyYTmYdGcXds&s=D5q6yBl5Si5o5OcAbw-QXVB6tiyQ6FfTBEIeiseEykk&e=" target="_blank">
wicar.org</a> will provide a bunch of POC hits that will show up in your logs if all is running properly.
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hi Brad,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have used wget <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__rules.emergingthreats.net_open_suricata_emerging.rules.tar.gz&d=DwMFaQ&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjhg&r=rOVyB9ixExmyqAgEyDnrUtIQ2jlUiP4p_9Yb9cbBi4A&m=JEDciNqScL2NUbSjQnDJp13bIWL57MsiyYTmYdGcXds&s=bDtDtyHsUF8irGdKGSzNMFKvrMBBLF9erw5b1tCavok&e=">
http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz</a> to download it under /etc/suricata/rules/ and then copied emerging-user_agents.rules to /etc/suricata/rules/. I have restarted suricata service. I did not understand about POC hits using <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.wicar.org_&d=DwMFaQ&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjhg&r=rOVyB9ixExmyqAgEyDnrUtIQ2jlUiP4p_9Yb9cbBi4A&m=JEDciNqScL2NUbSjQnDJp13bIWL57MsiyYTmYdGcXds&s=7Ou2yMwcxDssv78FvFMm_VgORAZGiXwKK3-D3ulVUWg&e=">http://www.wicar.org/</a>
Please comment.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks in Advance.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Best Regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Kaushal<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>