[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF95NGYJ02AC44G4CFP6MH":3,"skill-same:01M6AF95NGYJ02AC44G4CFP6MH":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AF95NGYJ02AC44G4CFP6MH","implementing-network-intrusion-prevention-with-suricata",null,"Deploys and configures Suricata as an inline network intrusion prevention system, covering IPS mode setup (NFQueue), custom rule writing, Emerging Threats ruleset management, performance tuning, and logging integration. Use when deploying real-time inline traffic inspection to actively block malicious traffic, or when tuning Suricata rules and performance for production IDS\u002FIPS deployment.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-network-intrusion-prevention-with-suricata\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"suricata","implementing network intrusion prevention with suricata","prevention","network","cybersecurity","pr","deployment","logging","performance","ids","writing","ips","real-time","tuning","security","emerging-threats","rule-management","nfqueue","inline-mode","malicious","2026-11-10 10:12:30",false,"---\nname: implementing-network-intrusion-prevention-with-suricata\ndescription: Deploys and configures Suricata as an inline network intrusion prevention system,\n  covering IPS mode setup (NFQueue), custom rule writing, Emerging Threats ruleset\n  management, performance tuning, and logging integration. Use when deploying real-time\n  inline traffic inspection to actively block malicious traffic, or when tuning\n  Suricata rules and performance for production IDS\u002FIPS deployment.\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- suricata\n- ips\n- ids\n- intrusion-prevention\n- network-security\n- emerging-threats\n- rule-management\n- nfqueue\n- inline-mode\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n---\n\n# Implementing Network Intrusion Prevention with Suricata\n\n## Overview\n\nSuricata is a high-performance, open-source network threat detection engine developed by the Open Information Security Foundation (OISF). It functions as an IDS (Intrusion Detection System), IPS (Intrusion Prevention System), and network security monitoring tool. Suricata performs deep packet inspection using extensive rule sets, protocol analysis, and file extraction capabilities. In IPS mode, Suricata inspects packets inline and can actively block malicious traffic. This skill covers deploying Suricata in IPS mode, configuring rulesets, writing custom rules, performance tuning, and integration with logging infrastructure.\n\n\n## When to Use\n\n- When deploying or configuring implementing network intrusion prevention with suricata capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Linux server (Ubuntu 22.04+ or CentOS 8+) with 4+ CPU cores and 8GB+ RAM\n- Suricata 7.0+ installed\n- Network position for inline deployment (bridge mode or NFQUEUE)\n- Emerging Threats Open or ET Pro ruleset subscription\n- Suricata-update tool for rule management\n- Logging infrastructure (ELK Stack, Splunk, or Wazuh)\n\n## Core Concepts\n\n### Operating Modes\n\n| Mode | Function | Network Position |\n|------|----------|-----------------|\n| IDS (AF_PACKET) | Passive monitoring, alert-only | TAP\u002FSPAN mirror |\n| IPS (NFQUEUE) | Inline blocking via netfilter | In traffic path |\n| IPS (AF_PACKET) | Inline blocking via AF_PACKET | Bridge between interfaces |\n| Offline (PCAP) | Analyze captured traffic files | N\u002FA |\n\n### Rule Anatomy\n\nSuricata rules follow a structured format:\n\n```\naction protocol src_ip src_port -> dst_ip dst_port (rule_options;)\n```\n\n- **Action**: `alert`, `pass`, `drop`, `reject`, `rejectsrc`, `rejectdst`, `rejectboth`\n- **Protocol**: `tcp`, `udp`, `icmp`, `ip`, `http`, `tls`, `dns`, `smtp`, `ftp`\n- **Direction**: `->` (unidirectional), `\u003C>` (bidirectional)\n\n### Rule Categories\n\n- **Emerging Threats Open** - Community-maintained, free ruleset with broad coverage\n- **ET Pro** - Commercial ruleset from Proofpoint with enhanced coverage\n- **Suricata Traffic ID** - Application identification rules\n- **Custom Rules** - Organization-specific detections\n\n## Workflow\n\n### Step 1: Install Suricata\n\n```bash\n# Add Suricata PPA (Ubuntu)\nsudo add-apt-repository ppa:oisf\u002Fsuricata-stable\nsudo apt-get update\nsudo apt-get install -y suricata suricata-update\n\n# Verify installation\nsuricata --build-info\nsuricata -V\n```\n\n### Step 2: Configure Suricata for IPS Mode\n\nEdit `\u002Fetc\u002Fsuricata\u002Fsuricata.yaml`:\n\n```yaml\n%YAML 1.1\n---\n\nvars:\n  address-groups:\n    HOME_NET: \"[10.0.0.0\u002F8,172.16.0.0\u002F12,192.168.0.0\u002F16]\"\n    EXTERNAL_NET: \"!$HOME_NET\"\n    HTTP_SERVERS: \"$HOME_NET\"\n    DNS_SERVERS: \"[10.0.1.10\u002F32,10.0.1.11\u002F32]\"\n    SMTP_SERVERS: \"$HOME_NET\"\n\n  port-groups:\n    HTTP_PORTS: \"80\"\n    SHELLCODE_PORTS: \"!80\"\n    SSH_PORTS: \"22\"\n    DNS_PORTS: \"53\"\n\n# IPS mode with NFQUEUE\nnfq:\n  mode: accept\n  repeat-mark: 1\n  repeat-mask: 1\n  route-queue: 2\n  fail-open: yes\n\n# Threading configuration\nthreading:\n  set-cpu-affinity: yes\n  cpu-affinity:\n    - management-cpu-set:\n        cpu: [0]\n    - receive-cpu-set:\n        cpu: [1,2]\n    - worker-cpu-set:\n        cpu: [3,4,5,6,7]\n        mode: exclusive\n\n# Detection engine\ndetect-engine:\n  - profile: high\n  - custom-values:\n      toclient-groups: 50\n      toserver-groups: 50\n  - sgh-mpm-context: auto\n  - inspection-recursion-limit: 3000\n\n# Stream engine\nstream:\n  memcap: 512mb\n  checksum-validation: yes\n  inline: auto\n  reassembly:\n    memcap: 1gb\n    depth: 1mb\n    toserver-chunk-size: 2560\n    toclient-chunk-size: 2560\n\n# Logging configuration\noutputs:\n  - eve-log:\n      enabled: yes\n      filetype: regular\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json\n      types:\n        - alert:\n            payload: yes\n            payload-buffer-size: 4kb\n            payload-printable: yes\n            packet: yes\n            metadata: yes\n            tagged-packets: yes\n        - http:\n            extended: yes\n        - dns:\n            query: yes\n            answer: yes\n        - tls:\n            extended: yes\n        - files:\n            force-magic: yes\n            force-hash: [md5, sha256]\n        - flow\n        - netflow\n        - stats:\n            totals: yes\n            threads: no\n            deltas: yes\n\n  - fast:\n      enabled: yes\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Ffast.log\n\n  - stats:\n      enabled: yes\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Fstats.log\n      interval: 30\n\n# Rule files\ndefault-rule-path: \u002Fvar\u002Flib\u002Fsuricata\u002Frules\nrule-files:\n  - suricata.rules\n```\n\n### Step 3: Configure NFQUEUE for Inline IPS\n\nSet up iptables to redirect traffic through Suricata:\n\n```bash\n# Enable IP forwarding\necho 1 > \u002Fproc\u002Fsys\u002Fnet\u002Fipv4\u002Fip_forward\n\n# Redirect FORWARD chain to NFQUEUE\nsudo iptables -I FORWARD -j NFQUEUE --queue-num 0 --queue-bypass\n\n# For multi-queue (better performance)\nsudo iptables -I FORWARD -j NFQUEUE --queue-balance 0:3 --queue-bypass\n\n# Save iptables rules\nsudo iptables-save > \u002Fetc\u002Fiptables\u002Frules.v4\n```\n\nAlternative: AF_PACKET inline mode between two interfaces:\n\n```yaml\n# In suricata.yaml\naf-packet:\n  - interface: eth0\n    cluster-id: 98\n    cluster-type: cluster_flow\n    defrag: yes\n    use-mmap: yes\n    copy-mode: ips\n    copy-iface: eth1\n  - interface: eth1\n    cluster-id: 97\n    cluster-type: cluster_flow\n    defrag: yes\n    use-mmap: yes\n    copy-mode: ips\n    copy-iface: eth0\n```\n\n### Step 4: Manage Rules with Suricata-Update\n\n```bash\n# Update rules from default sources (ET Open)\nsudo suricata-update\n\n# List available rule sources\nsudo suricata-update list-sources\n\n# Enable ET Pro (requires license key)\nsudo suricata-update enable-source et\u002Fpro secret-code=YOUR_OINKCODE\n\n# Enable additional sources\nsudo suricata-update enable-source oisf\u002Ftrafficid\nsudo suricata-update enable-source ptresearch\u002Fattackdetection\nsudo suricata-update enable-source sslbl\u002Fssl-fp-blacklist\n\n# Disable specific rules that generate false positives\necho \"2100498\" >> \u002Fetc\u002Fsuricata\u002Fdisable.conf\necho \"group:emerging-policy.rules\" >> \u002Fetc\u002Fsuricata\u002Fdisable.conf\n\n# Modify rule actions (change alert to drop)\necho 're:ET MALWARE' >> \u002Fetc\u002Fsuricata\u002Fmodify.conf\n\n# Apply updates\nsudo suricata-update --reload-command=\"suricatasc -c reload-rules\"\n```\n\n### Step 5: Write Custom Rules\n\nCreate `\u002Fvar\u002Flib\u002Fsuricata\u002Frules\u002Flocal.rules`:\n\n```\n# Detect potential reverse shell over TCP\ndrop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Potential Reverse Shell - \u002Fbin\u002Fbash in payload\"; flow:to_server,established; content:\"\u002Fbin\u002Fbash\"; content:\"-i\"; within:20; classtype:trojan-activity; sid:1000001; rev:1;)\n\n# Block known malicious user agent\ndrop http $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Malicious User-Agent - Cobalt Strike\"; http.user_agent; content:\"Mozilla\u002F5.0 (compatible|3b| MSIE 9.0|3b| Windows NT 6.1|3b| WOW64|3b| Trident\u002F5.0)\"; classtype:trojan-activity; sid:1000002; rev:1;)\n\n# Detect DNS query for known DGA domain pattern\nalert dns $HOME_NET any -> any 53 (msg:\"LOCAL Suspicious DGA Domain Query\"; dns.query; content:\".top\"; pcre:\"\u002F^[a-z0-9]{12,30}\\.(top|xyz|club|online|site)$\u002F\"; classtype:bad-unknown; sid:1000003; rev:1;)\n\n# Detect large DNS TXT response (potential C2)\nalert dns any 53 -> $HOME_NET any (msg:\"LOCAL Large DNS TXT Response - Potential C2\"; dns.opcode:0; content:\"|00 10|\"; byte_test:2,>,500,0,relative; classtype:bad-unknown; sid:1000004; rev:1;)\n\n# Block outbound traffic to Tor exit nodes\ndrop tcp $HOME_NET any -> [100.2.18.10,104.244.76.13,109.70.100.1] any (msg:\"LOCAL Outbound Connection to Known Tor Exit Node\"; classtype:policy-violation; sid:1000005; rev:1;)\n\n# Detect SMB lateral movement attempts\nalert tcp $HOME_NET any -> $HOME_NET 445 (msg:\"LOCAL Internal SMB Connection - Possible Lateral Movement\"; flow:to_server,established; content:\"|ff|SMB\"; offset:4; depth:4; threshold:type both,track by_src,count 5,seconds 60; classtype:attempted-admin; sid:1000006; rev:1;)\n\n# Detect PowerShell download cradle\ndrop http $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL PowerShell Download Cradle Detected\"; http.user_agent; content:\"PowerShell\"; nocase; http.method; content:\"GET\"; classtype:trojan-activity; sid:1000007; rev:1;)\n\n# Detect ICMP tunneling (large ICMP packets)\nalert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Oversized ICMP Packet - Possible Tunneling\"; dsize:>800; threshold:type both,track by_src,count 10,seconds 60; classtype:bad-unknown; sid:1000008; rev:1;)\n```\n\n### Step 6: Start Suricata in IPS Mode\n\n```bash\n# Test configuration\nsudo suricata -T -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n\n# Start in NFQUEUE IPS mode\nsudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml -q 0\n\n# Start with AF_PACKET inline mode\nsudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml --af-packet\n\n# Start as systemd service\nsudo systemctl enable suricata\nsudo systemctl start suricata\n\n# Monitor performance stats\ntail -f \u002Fvar\u002Flog\u002Fsuricata\u002Fstats.log\n\n# Reload rules without restart\nsudo suricatasc -c reload-rules\n```\n\n## Monitoring and Tuning\n\n### Performance Metrics\n\n```bash\n# Check kernel drops\nsudo suricatasc -c dump-counters | grep -E \"capture.kernel_drops|decoder.pkts\"\n\n# Monitor EVE JSON alerts\ntail -f \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq 'select(.event_type==\"alert\")'\n\n# Check rule loading\ngrep -c \"rules loaded\" \u002Fvar\u002Flog\u002Fsuricata\u002Fsuricata.log\n\n# Memory usage\nsudo suricatasc -c dump-counters | grep memuse\n```\n\n### Tuning for False Positives\n\n```bash\n# Identify noisy rules\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"alert\") | .alert.signature_id' | sort | uniq -c | sort -rn | head -20\n\n# Suppress specific rules per source\necho \"suppress gen_id 1, sig_id 2100498, track by_src, ip 10.0.5.0\u002F24\" >> \u002Fetc\u002Fsuricata\u002Fthreshold.config\n\n# Rate-limit alerts\necho \"rate_filter gen_id 1, sig_id 2100366, track by_src, count 10, seconds 60, new_action alert, timeout 300\" >> \u002Fetc\u002Fsuricata\u002Fthreshold.config\n```\n\n## Best Practices\n\n- **Start in IDS Mode** - Deploy in IDS (alert-only) mode first, tune for 2-4 weeks, then switch to IPS\n- **Fail-Open** - Configure fail-open mode so network traffic continues if Suricata crashes\n- **Rule Tuning** - Use threshold and suppress directives to reduce false positives before enabling drop actions\n- **CPU Affinity** - Pin Suricata worker threads to dedicated CPU cores for consistent performance\n- **Bypass for Trusted Traffic** - Use `pass` rules for known-good traffic to reduce processing load\n- **Regular Updates** - Run `suricata-update` daily via cron to keep signatures current\n- **Monitor Drops** - Track kernel packet drops and increase ring buffer size if needed\n\n## References\n\n- [Suricata Documentation](https:\u002F\u002Fdocs.suricata.io\u002Fen\u002Flatest\u002F)\n- [Suricata Rules Format](https:\u002F\u002Fdocs.suricata.io\u002Fen\u002Flatest\u002Frules\u002Findex.html)\n- [Emerging Threats Rulesets](https:\u002F\u002Frules.emergingthreats.net\u002F)\n- [OISF Suricata GitHub](https:\u002F\u002Fgithub.com\u002FOISF\u002Fsuricata)\n- [Suricata-Update Documentation](https:\u002F\u002Fsuricata-update.readthedocs.io\u002F)\n","# Implementing Network Intrusion Prevention with Suricata\n\n## Overview\n\nSuricata is a high-performance, open-source network threat detection engine developed by the Open Information Security Foundation (OISF). It functions as an IDS (Intrusion Detection System), IPS (Intrusion Prevention System), and network security monitoring tool. Suricata performs deep packet inspection using extensive rule sets, protocol analysis, and file extraction capabilities. In IPS mode, Suricata inspects packets inline and can actively block malicious traffic. This skill covers deploying Suricata in IPS mode, configuring rulesets, writing custom rules, performance tuning, and integration with logging infrastructure.\n\n\n## When to Use\n\n- When deploying or configuring implementing network intrusion prevention with suricata capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Linux server (Ubuntu 22.04+ or CentOS 8+) with 4+ CPU cores and 8GB+ RAM\n- Suricata 7.0+ installed\n- Network position for inline deployment (bridge mode or NFQUEUE)\n- Emerging Threats Open or ET Pro ruleset subscription\n- Suricata-update tool for rule management\n- Logging infrastructure (ELK Stack, Splunk, or Wazuh)\n\n## Core Concepts\n\n### Operating Modes\n\n| Mode | Function | Network Position |\n|------|----------|-----------------|\n| IDS (AF_PACKET) | Passive monitoring, alert-only | TAP\u002FSPAN mirror |\n| IPS (NFQUEUE) | Inline blocking via netfilter | In traffic path |\n| IPS (AF_PACKET) | Inline blocking via AF_PACKET | Bridge between interfaces |\n| Offline (PCAP) | Analyze captured traffic files | N\u002FA |\n\n### Rule Anatomy\n\nSuricata rules follow a structured format:\n\n```\naction protocol src_ip src_port -> dst_ip dst_port (rule_options;)\n```\n\n- **Action**: `alert`, `pass`, `drop`, `reject`, `rejectsrc`, `rejectdst`, `rejectboth`\n- **Protocol**: `tcp`, `udp`, `icmp`, `ip`, `http`, `tls`, `dns`, `smtp`, `ftp`\n- **Direction**: `->` (unidirectional), `\u003C>` (bidirectional)\n\n### Rule Categories\n\n- **Emerging Threats Open** - Community-maintained, free ruleset with broad coverage\n- **ET Pro** - Commercial ruleset from Proofpoint with enhanced coverage\n- **Suricata Traffic ID** - Application identification rules\n- **Custom Rules** - Organization-specific detections\n\n## Workflow\n\n### Step 1: Install Suricata\n\n```bash\n# Add Suricata PPA (Ubuntu)\nsudo add-apt-repository ppa:oisf\u002Fsuricata-stable\nsudo apt-get update\nsudo apt-get install -y suricata suricata-update\n\n# Verify installation\nsuricata --build-info\nsuricata -V\n```\n\n### Step 2: Configure Suricata for IPS Mode\n\nEdit `\u002Fetc\u002Fsuricata\u002Fsuricata.yaml`:\n\n```yaml\n%YAML 1.1\n---\n\nvars:\n  address-groups:\n    HOME_NET: \"[10.0.0.0\u002F8,172.16.0.0\u002F12,192.168.0.0\u002F16]\"\n    EXTERNAL_NET: \"!$HOME_NET\"\n    HTTP_SERVERS: \"$HOME_NET\"\n    DNS_SERVERS: \"[10.0.1.10\u002F32,10.0.1.11\u002F32]\"\n    SMTP_SERVERS: \"$HOME_NET\"\n\n  port-groups:\n    HTTP_PORTS: \"80\"\n    SHELLCODE_PORTS: \"!80\"\n    SSH_PORTS: \"22\"\n    DNS_PORTS: \"53\"\n\n# IPS mode with NFQUEUE\nnfq:\n  mode: accept\n  repeat-mark: 1\n  repeat-mask: 1\n  route-queue: 2\n  fail-open: yes\n\n# Threading configuration\nthreading:\n  set-cpu-affinity: yes\n  cpu-affinity:\n    - management-cpu-set:\n        cpu: [0]\n    - receive-cpu-set:\n        cpu: [1,2]\n    - worker-cpu-set:\n        cpu: [3,4,5,6,7]\n        mode: exclusive\n\n# Detection engine\ndetect-engine:\n  - profile: high\n  - custom-values:\n      toclient-groups: 50\n      toserver-groups: 50\n  - sgh-mpm-context: auto\n  - inspection-recursion-limit: 3000\n\n# Stream engine\nstream:\n  memcap: 512mb\n  checksum-validation: yes\n  inline: auto\n  reassembly:\n    memcap: 1gb\n    depth: 1mb\n    toserver-chunk-size: 2560\n    toclient-chunk-size: 2560\n\n# Logging configuration\noutputs:\n  - eve-log:\n      enabled: yes\n      filetype: regular\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json\n      types:\n        - alert:\n            payload: yes\n            payload-buffer-size: 4kb\n            payload-printable: yes\n            packet: yes\n            metadata: yes\n            tagged-packets: yes\n        - http:\n            extended: yes\n        - dns:\n            query: yes\n            answer: yes\n        - tls:\n            extended: yes\n        - files:\n            force-magic: yes\n            force-hash: [md5, sha256]\n        - flow\n        - netflow\n        - stats:\n            totals: yes\n            threads: no\n            deltas: yes\n\n  - fast:\n      enabled: yes\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Ffast.log\n\n  - stats:\n      enabled: yes\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Fstats.log\n      interval: 30\n\n# Rule files\ndefault-rule-path: \u002Fvar\u002Flib\u002Fsuricata\u002Frules\nrule-files:\n  - suricata.rules\n```\n\n### Step 3: Configure NFQUEUE for Inline IPS\n\nSet up iptables to redirect traffic through Suricata:\n\n```bash\n# Enable IP forwarding\necho 1 > \u002Fproc\u002Fsys\u002Fnet\u002Fipv4\u002Fip_forward\n\n# Redirect FORWARD chain to NFQUEUE\nsudo iptables -I FORWARD -j NFQUEUE --queue-num 0 --queue-bypass\n\n# For multi-queue (better performance)\nsudo iptables -I FORWARD -j NFQUEUE --queue-balance 0:3 --queue-bypass\n\n# Save iptables rules\nsudo iptables-save > \u002Fetc\u002Fiptables\u002Frules.v4\n```\n\nAlternative: AF_PACKET inline mode between two interfaces:\n\n```yaml\n# In suricata.yaml\naf-packet:\n  - interface: eth0\n    cluster-id: 98\n    cluster-type: cluster_flow\n    defrag: yes\n    use-mmap: yes\n    copy-mode: ips\n    copy-iface: eth1\n  - interface: eth1\n    cluster-id: 97\n    cluster-type: cluster_flow\n    defrag: yes\n    use-mmap: yes\n    copy-mode: ips\n    copy-iface: eth0\n```\n\n### Step 4: Manage Rules with Suricata-Update\n\n```bash\n# Update rules from default sources (ET Open)\nsudo suricata-update\n\n# List available rule sources\nsudo suricata-update list-sources\n\n# Enable ET Pro (requires license key)\nsudo suricata-update enable-source et\u002Fpro secret-code=YOUR_OINKCODE\n\n# Enable additional sources\nsudo suricata-update enable-source oisf\u002Ftrafficid\nsudo suricata-update enable-source ptresearch\u002Fattackdetection\nsudo suricata-update enable-source sslbl\u002Fssl-fp-blacklist\n\n# Disable specific rules that generate false positives\necho \"2100498\" >> \u002Fetc\u002Fsuricata\u002Fdisable.conf\necho \"group:emerging-policy.rules\" >> \u002Fetc\u002Fsuricata\u002Fdisable.conf\n\n# Modify rule actions (change alert to drop)\necho 're:ET MALWARE' >> \u002Fetc\u002Fsuricata\u002Fmodify.conf\n\n# Apply updates\nsudo suricata-update --reload-command=\"suricatasc -c reload-rules\"\n```\n\n### Step 5: Write Custom Rules\n\nCreate `\u002Fvar\u002Flib\u002Fsuricata\u002Frules\u002Flocal.rules`:\n\n```\n# Detect potential reverse shell over TCP\ndrop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Potential Reverse Shell - \u002Fbin\u002Fbash in payload\"; flow:to_server,established; content:\"\u002Fbin\u002Fbash\"; content:\"-i\"; within:20; classtype:trojan-activity; sid:1000001; rev:1;)\n\n# Block known malicious user agent\ndrop http $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Malicious User-Agent - Cobalt Strike\"; http.user_agent; content:\"Mozilla\u002F5.0 (compatible|3b| MSIE 9.0|3b| Windows NT 6.1|3b| WOW64|3b| Trident\u002F5.0)\"; classtype:trojan-activity; sid:1000002; rev:1;)\n\n# Detect DNS query for known DGA domain pattern\nalert dns $HOME_NET any -> any 53 (msg:\"LOCAL Suspicious DGA Domain Query\"; dns.query; content:\".top\"; pcre:\"\u002F^[a-z0-9]{12,30}\\.(top|xyz|club|online|site)$\u002F\"; classtype:bad-unknown; sid:1000003; rev:1;)\n\n# Detect large DNS TXT response (potential C2)\nalert dns any 53 -> $HOME_NET any (msg:\"LOCAL Large DNS TXT Response - Potential C2\"; dns.opcode:0; content:\"|00 10|\"; byte_test:2,>,500,0,relative; classtype:bad-unknown; sid:1000004; rev:1;)\n\n# Block outbound traffic to Tor exit nodes\ndrop tcp $HOME_NET any -> [100.2.18.10,104.244.76.13,109.70.100.1] any (msg:\"LOCAL Outbound Connection to Known Tor Exit Node\"; classtype:policy-violation; sid:1000005; rev:1;)\n\n# Detect SMB lateral movement attempts\nalert tcp $HOME_NET any -> $HOME_NET 445 (msg:\"LOCAL Internal SMB Connection - Possible Lateral Movement\"; flow:to_server,established; content:\"|ff|SMB\"; offset:4; depth:4; threshold:type both,track by_src,count 5,seconds 60; classtype:attempted-admin; sid:1000006; rev:1;)\n\n# Detect PowerShell download cradle\ndrop http $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL PowerShell Download Cradle Detected\"; http.user_agent; content:\"PowerShell\"; nocase; http.method; content:\"GET\"; classtype:trojan-activity; sid:1000007; rev:1;)\n\n# Detect ICMP tunneling (large ICMP packets)\nalert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Oversized ICMP Packet - Possible Tunneling\"; dsize:>800; threshold:type both,track by_src,count 10,seconds 60; classtype:bad-unknown; sid:1000008; rev:1;)\n```\n\n### Step 6: Start Suricata in IPS Mode\n\n```bash\n# Test configuration\nsudo suricata -T -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n\n# Start in NFQUEUE IPS mode\nsudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml -q 0\n\n# Start with AF_PACKET inline mode\nsudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml --af-packet\n\n# Start as systemd service\nsudo systemctl enable suricata\nsudo systemctl start suricata\n\n# Monitor performance stats\ntail -f \u002Fvar\u002Flog\u002Fsuricata\u002Fstats.log\n\n# Reload rules without restart\nsudo suricatasc -c reload-rules\n```\n\n## Monitoring and Tuning\n\n### Performance Metrics\n\n```bash\n# Check kernel drops\nsudo suricatasc -c dump-counters | grep -E \"capture.kernel_drops|decoder.pkts\"\n\n# Monitor EVE JSON alerts\ntail -f \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq 'select(.event_type==\"alert\")'\n\n# Check rule loading\ngrep -c \"rules loaded\" \u002Fvar\u002Flog\u002Fsuricata\u002Fsuricata.log\n\n# Memory usage\nsudo suricatasc -c dump-counters | grep memuse\n```\n\n### Tuning for False Positives\n\n```bash\n# Identify noisy rules\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"alert\") | .alert.signature_id' | sort | uniq -c | sort -rn | head -20\n\n# Suppress specific rules per source\necho \"suppress gen_id 1, sig_id 2100498, track by_src, ip 10.0.5.0\u002F24\" >> \u002Fetc\u002Fsuricata\u002Fthreshold.config\n\n# Rate-limit alerts\necho \"rate_filter gen_id 1, sig_id 2100366, track by_src, count 10, seconds 60, new_action alert, timeout 300\" >> \u002Fetc\u002Fsuricata\u002Fthreshold.config\n```\n\n## Best Practices\n\n- **Start in IDS Mode** - Deploy in IDS (alert-only) mode first, tune for 2-4 weeks, then switch to IPS\n- **Fail-Open** - Configure fail-open mode so network traffic continues if Suricata crashes\n- **Rule Tuning** - Use threshold and suppress directives to reduce false positives before enabling drop actions\n- **CPU Affinity** - Pin Suricata worker threads to dedicated CPU cores for consistent performance\n- **Bypass for Trusted Traffic** - Use `pass` rules for known-good traffic to reduce processing load\n- **Regular Updates** - Run `suricata-update` daily via cron to keep signatures current\n- **Monitor Drops** - Track kernel packet drops and increase ring buffer size if needed\n\n## References\n\n- [Suricata Documentation](https:\u002F\u002Fdocs.suricata.io\u002Fen\u002Flatest\u002F)\n- [Suricata Rules Format](https:\u002F\u002Fdocs.suricata.io\u002Fen\u002Flatest\u002Frules\u002Findex.html)\n- [Emerging Threats Rulesets](https:\u002F\u002Frules.emergingthreats.net\u002F)\n- [OISF Suricata GitHub](https:\u002F\u002Fgithub.com\u002FOISF\u002Fsuricata)\n- [Suricata-Update Documentation](https:\u002F\u002Fsuricata-update.readthedocs.io\u002F)\n",{"name":5,"tags":49,"author":52,"domain":28,"license":15,"version":53,"nist_csf":54,"subdomain":51,"description":7,"mitre_attack":59},[24,35,33,50,51,39,40,41,42],"intrusion-prevention","network-security","mahipal","1.0",[55,56,57,58],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02",[60,61,62,63],"T1046","T1040","T1557","T1071","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-network-intrusion-prevention-with-suricata",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-network-intrusion-prevention-with-suricata",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-network-intrusion-prevention-with-suricata",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-network-intrusion-prevention-with-suricata","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-network-intrusion-prevention-with-suricata\u002FSKILL.md",true,[88,93,99],{"path":89,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-network-intrusion-prevention-with-suricata\u002FLICENSE",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fapi-reference.md","REFERENCE","参考文档",2971,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-network-intrusion-prevention-with-suricata\u002Freferences\u002Fapi-reference.md",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Fagent.py","SCRIPT","脚本",6533,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-network-intrusion-prevention-with-suricata\u002Fscripts\u002Fagent.py",[106,131,155,183,209,236],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":113,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[112],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,115,116,117,38,28,118,119,29,120,121,122,123,124,125,126,127,128,129,130],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[137],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,127,140,141,38,142,28,29,143,144,145,146,147,148,149,150,151,152,153,154],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":165,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[161,164],{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[149,166,167,168,169,28,170,171,143,172,173,174,175,176,177,178,179,180,181,182],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":190,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[189],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[191,192,193,28,194,195,196,197,198,199,200,201,202,203,204,205,146,206,207,208],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[215],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[217,218,219,28,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[242],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[38,244,28,245,246,247,248,249,250,251,252,178,253,179,254,255,256,257,258,259],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]