Suricata alerts every day - should I be concerned?

Rules
1

Hello,

Still a pretty newbie person to Suricata. I get several ‘SURICATA’ alerts pretty much every day:

2230027 SURICATA TLS certificate invalid der
2224004 SURICATA IKEv2 weak cryptographic parameters (Auth)
2224002 SURICATA IKEv2 weak cryptographic parameters (Encryption)
2224005 SURICATA IKEv2 weak cryptographic parameters (Diffie-Hellman)
2224003 SURICATA IKEv2 weak cryptographic parameters (PRF)
2210035 SURICATA STREAM FIN2 FIN with wrong seq
2210036 SURICATA STREAM FIN2 invalid ack
2210020 SURICATA STREAM ESTABLISHED packet out of window
2210030 SURICATA STREAM FIN invalid ack
2210029 SURICATA STREAM ESTABLISHED invalid ack
2210056 SURICATA STREAM bad window update
2210055 SURICATA STREAM 3way handshake excessive different SYN/ACKs

I was just wondering if I should be worried about anything. I’m not sure how to interpret these. If anyone has any light to shed, I’m all ears.

Jamie

2

Hi Jamie,

The rules you have listed are what could be considered information/anomaly type alerts. They indicate conditions with the negotiation of TCP streams and encryption handshakes.