Suricata IP Reputation / Blacklisting

Help
1

hi ,
I am trying to alert / ignore traffic from a list of blacklisted IP
I am using IP Reputation mentioned in docs

reputation-categories-file: /usr/local/etc/suricata/iprep/categories.txt
default-reputation-path: /usr/local/etc/suricata/iprep
reputation-files:
 - reputation.list

My categories.txt

1,BadHosts,Known bad hosts

My Reputation List

10.0.0.1,1,1
10.0.0.2,1,100

I tried value 1 and 100 , it doesn’t affect , I can see this IP in eve.json
Here I want to know that do i need to create rules also using iprep ??
or what’s wrong

2

Hi,

I think you are missing the rules where to indicate the value of reputation. In my case it is: 80

alert ip any any -> any any (msg:"IPREP - Blocklist IP";iprep:any,Blocklist,>,80;sid:40004;rev:1;)

3

Thanks bro , it worked

1 Like