Create customize suricata using bash script

I know that report in suricata like fast.log can be customized using lua script (fast.lua) but is it possible to use bash script to have the similar custom report like I’m more familar with bash scripting.

There is no direct bash support, no. You could use different outputs, especially the advanced eve output and use postprocessing.

Thanks for the suggestion. Can we make the eve output only display alert log like fast.log? There are a bunch of JSON data in eve output even if alert is not triggered. I think this can be customized in suricata.yaml, but there are too many of them. Can anyone show me this config that will make eve.json output the similar thing from fast.log ?

In your suricata.yaml you will want to limit the types that are logged to just alert. See this part of the YAML:

And remove all types from that array except alert, and you will only get alerts. It’ll still be JSON, but should align with what you see in fast.log.

1 Like

Thank you so much, I will try this.