Intrusion Detection (Suricata)
Suricata is a network intrusion detection sensor that Quave ONE can run on the nodes of your private region.
It watches the traffic on those nodes, compares it against a set of rules, and records a detection every time a rule matches.
Availability. Suricata is a region add-on, available on the Quave ONE Connect plans for a private region that serves only your account.
Detection, not blocking
Suricata runs beside the traffic, not in front of it.
A rule that matches creates a detection and, if you asked for it, a notification.
Nothing is dropped and no connection is cut.
So write your rules with the alert action.
drop and reject pass the syntax check, but they block nothing on this setup.
Opening the add-on
Open Add-ons from the main navigation, then pick the region if your account has more than one.
The Suricata card is there.
The card shows, in this order: the add-on name, whether it is On or Off, a one-line summary, and a status line.
If Suricata is not installed yet, the editor says: "Not running on the nodes of <region> yet. Ask Quave to install it; what you write here is kept and applied once it runs."
Some parts of the add-on are managed by Quave and are not on your screen: installing and removing the sensor, where the detections are stored, and the dashboards built on top of them.
Rules list
The list is what the sensor is loading right now, no matter who wrote it.
The header counts the parts: 12 yours · 68 sets on · loaded on these nodes.
A rule that is commented out in the file shows as off and is counted apart: it is kept, but it is not applied.
The list has two kinds of row:
- Your rules. One box per rule, collapsed to its title. The title is the rule's
msg:"..."and the badge next to it is itssid. Click the title to open and edit it. - Rule sets that ship with the sensor. Files from the Suricata and ET Open rulesets, such as
emerging-malware.rulesandemerging-scan.rules.
Three columns follow each row:
| Column | What it shows |
|---|---|
| Origin | Where the row came from: Custom (you wrote it), Quave (it came from one of our examples), or Suricata / ET Open for a set that ships with the sensor |
| Alerts | How many detections that sid raised, counted over the window picked in Alerts from the last, from 5 minutes to 30 days, 7 days by default. A — means the count could not be read, which is not the same as zero |
| Actions | Remove the rule, or turn the set off |
Writing a rule
Add rule adds a box with a starter rule that you edit in place.
Paste takes a block of rules (a file you already have, for example) and splits it into boxes.
The examples catalogue offers rules you can adopt as your own.
To write the rule itself, read the official Suricata documentation: actions, protocols, direction, and the full keyword list are there, and this page does not repeat any of it.
Check rules validates the rules without saving; when they pass, it answers "The configuration is valid".
Notifications
Detections are recorded whether or not anyone is told about them.
The Notifications box, inside the editor, is what turns a detection into a message.
It is the same alerting as the rest of the platform:
- Send to: the contact points of your account. See how to create a contact point.
- Threshold, Counted over, and Pending period: the condition.
- Send test: sends a real message down the real path and reports, per contact point, whether it arrived.
- Silence alert: stops the sending without taking apart the destination, the condition, or the rules.
Where detections are stored
Each node sends them to the OpenSearch or Elasticsearch destination set for the region.
That destination can be a cluster of yours, or Quave can run one for you inside Quave ONE itself: OpenSearch is a database preset on the platform and is created by a Quave operator.
Talk to support to decide which way to go.