Good morning .
I installed RaspbianOS and Suricata 6.1.0 on a Raspberry Pi 400 and had my data traffic analyzed.
To check whether suricatta is running as desired, I ran an ids test (GitHub - 3CORESec/testmynids.org: A website and framework for testing NIDS detection).
No alerts were visible in the log file, which means that Suricata 6.1.0 configured on Raspbianos according to the instructions from Suricata.org did not generate any alerts in the logfile.
So I have another Suricater 6.1.0 installed on another card in the (GitHub - 3CORESec/testmynids.org: A website and framework for testing NIDS detection) test which also shows up with alerts in the log file. as requested.
A diff on the suricata.yaml of the two installations showed no difference in the files of the two installations.
I’m at the end of my latain. With this posting I would like to contribute to the fact that it works with the installation of a Debian Suricata from the repository.
I then installed a RaspianOS version and installed 7.0.7 from the sources according to the instructions on suricata.org, which also didn’t produce any entries/alerts.
The rest of the entries were logged, just no alerts even after 10 days of evaluation. I think there’s something wrong with it
Thanks for the great work @ suricata
Max