From the course: Kali Purple Essential Training

Unlock the full course today

Join today to access over 24,000 courses taught by industry experts.

Adding Suricata IDS to the proxy

Adding Suricata IDS to the proxy - Purple Tutorial

From the course: Kali Purple Essential Training

Start my 1-month free trial Buy for my team

Adding Suricata IDS to the proxy

“

We've built Nginx as the proxy, providing an entry point into our lab. Let's give it an intrusion detection capability by installing the Suricata IDS. As a production system, we'd load this as a standalone Kali Purple IDS. But to minimize the number of servers we need for our lab, we'll install it on our proxy server. Okay. So let's install Suricata and the additional packages it needs. sudo apt install suricata jq gnupg2 and software-properties-common. And then draw a password and confirm. Okay. We need to update the configuration to specify our home network. We do that with sudo nano /etc/suricata/suricata.yaml. And we'll change home net to 192.168.1.0/24 and save that. Okay. Let's now fetch our default rule sets, which we do with sudo suricata-update. And finally, we'll enable and start up Suricata. Suudo systemctl enable suricata and we'll start it up now. Let's check. We're detecting bad things. We can send a curl command to a URL testmynids.org/uid/index.html. And this will…

Contents