I am successfully established suricata as IDPS in my PC. Now I trying to create signature rule to generate an alert for zoom, spotify and mega applications with the help of Datasets Keyword in suricata documentation. But the logs are not generated by suricata. I think i am configuring dataset in wrong way.
Kindly please help me.
@Eric_Leblond
Please help sir.
Big Fan.
Multiple points here:
So if i put full domain name in the dns-bl.lst such as zoom.us and all. Then it will work?
you need to look at the dns events generated when you sniff the traffic with suricata and then reuse the value.
Sir, i looked at the dns traffic that i captured in the wireshark. The domain name for zoom is zoom.us. when i created a normal rule to detect zoom traffic then it worked. I just put zoom keyword in the content of my signature rule.
so yes put zoom.us in the dataset
Steps:
Sir, all the configuration files are correct as i created many rules and also tested them. Suricata working properly with that rules. I am just enthusiast to create signature rules by using datasets.
Help me!!
run suricata in command line to see the errors. The dataset file for example is not base64 encoded so you should have a message in the log.
" instead of the “directional” quotes.
This is common when copy/pasting from rich text editors. I’ve suffered from this problem WAY too much.
wonder if we can “just” support the directional quotes
Shouldn’t be hard… Should proper symmetry be enforced as in “ must be terminated with a ”. Or allow nesting?
alert ... (msg:"Directional “directional” quotes found"; ...)
Expectations may differ here.
I have corrected all the errors that are appearing in the previous photo. Now the current status is this.
@ish @Eric_Leblond
Respected Members,
Finally, i am getting logs. But still not working.
I have some queries mentioned below such as the websites with the same domain names are still opening and the applications of the same are working. Kindly Check my steps and resolve my query that why the websites are working. I am still confused that the applications are blocked with my signature rule or some network issue, because without opening the specific application i mentioned in the dataset(dns-bl.lst) the logs generate.
Steps:
suricata.yaml -> datasets:
dns-bl:
type: string
state: dns-bl.lst
create a dataset name dns-bl.lst
zoom.us
open.spotify.com
mega.io
Create a Suricata custom rule: drop ip any any → any any (msg:“Datasets Configured”; dns_query; dataset:set,dns-bl,type string; sid:2736971; rev:1;)
List of Queries:
@Eric_Leblond @Regit @ish
I am waiting for you reply to resolve my query since from yesterday.
Please help me.