Leveraging Suricata in the Enterprise: Shifting from Events to Insights
summary
Shows a concrete workflow that turns Suricata’s raw output into actionable signals using SELKS, Scirius Community Edition, Kibana and VirusTotal. Claims 60k+ signatures and 2017 100 Gbps tests; demos include a TLS-old query returning ~160 hits, a “hidden executable” filter with ~20 hits, and file-extraction hunting that finds a VirusTotal-redlisted SMB executable. Introduces SELKS (Suricata+ELK+Scirius), advocates automated tagging and a target keyword adds alert.targets object so alerts map to assets, and shows filters that reduce millions of events to tens.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:31Suricata 101
- 7:07Suricata Context with Alerts - Application Layer
- 12:12Select Alerts by Filtering Use filtering methods to limit the number of alerts
- 25:52One Solution: Tagging for Priority Implementation possibilities: Run a set of queries of Elasticsearch to
- 33:07Challenges of relying on signature metadata alone
- 34:39Stamus Networks Open Source Contributions
related talks
58mHunting Malware with Suricata Metadata
30mTrawling for IOCs: Catching C2 in a Sea of Data
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
30mSpotting Threats with Elastic SIEM
27mCollect All the Data; Protect All the Things
45mAdvanced Security Operations with Elastic Security
29mHunting and Stopping Threats with Elastic Security