Suricata IP Reputation / Blacklisting

hi ,
I am trying to alert / ignore traffic from a list of blacklisted IP
I am using IP Reputation mentioned in docs

reputation-categories-file: /usr/local/etc/suricata/iprep/categories.txt
default-reputation-path: /usr/local/etc/suricata/iprep
 - reputation.list

My categories.txt

1,BadHosts,Known bad hosts

My Reputation List,1,1,1,100

I tried value 1 and 100 , it doesn’t affect , I can see this IP in eve.json
Here I want to know that do i need to create rules also using iprep ??
or what’s wrong


I think you are missing the rules where to indicate the value of reputation. In my case it is: 80

alert ip any any -> any any (msg:"IPREP - Blocklist IP";iprep:any,Blocklist,>,80;sid:40004;rev:1;)

Thanks bro , it worked

1 Like