Alert logs not triggered

I cannot see alerts logs in fast.log
I used ubuntu 16.04 and suricat 6

Uploading: 20201125_125621.jpg…


Do you have any rule activated that detects ping icmp ?.

On the other hand, try using a pcap to check if it generates other types of alerts. Also put here your suricata.yaml to review.

This is my rule et my suricata.yaml file


Much of the content of the yaml is missing. Try the following:

  • check that your rule is active in yaml.

  • try these rules:

    alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg: “Outbound ICMP detected”; sid:1; rev:1; classtype:icmp-custom-event;)

    alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: “Inbound ICMP detected”; sid:2; rev:1; classtype:icmp-custom-event;)