Alert logs not triggered

Help
1

I cannot see alerts logs in fast.log
I used ubuntu 16.04 and suricat 6

20201125_125621
20201125_1256213024×4032 2.48 MB
Uploading: 20201125_125621.jpg…

2

Hi,

Do you have any rule activated that detects ping icmp ?.

On the other hand, try using a pcap to check if it generates other types of alerts. Also put here your suricata.yaml to review.

3

20201126_174232
20201126_1742324032×828 1.02 MB
20201126_121640
20201126_1216403024×4032 2.67 MB

This is my rule et my suricata.yaml file

4

Hí,

Much of the content of the yaml is missing. Try the following:

  • check that your rule is active in yaml.

  • try these rules:

    alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg: “Outbound ICMP detected”; sid:1; rev:1; classtype:icmp-custom-event;)

    alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: “Inbound ICMP detected”; sid:2; rev:1; classtype:icmp-custom-event;)