CIS Suricata IDS/IPS Benchmark

This recommendation verifies that Suricata runs as a non-root user on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Suricata runs as non-root
ps -eo user,pid,comm | grep suricata
grep -E '^run-as' /etc/suricata/suricata.yaml

# Configure Suricata to run as non-root
# In suricata.yaml:
# run-as:
#   user: suricata
#   group: suricata
useradd -r -s /usr/sbin/nologin suricata
chown -R suricata:suricata /var/log/suricata /var/lib/suricata

This setting ensures that configuration file permissions are restricted on the Suricata intrusion detection/prevention system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Suricata intrusion detection/prevention system is essential for defense in depth.

# Check configuration file permissions
stat -c '%a %U %G' /etc/suricata/suricata.yaml
find /etc/suricata -type f -exec stat -c '%a %n' {} \;

# Restrict configuration permissions
chmod 640 /etc/suricata/suricata.yaml
chown root:suricata /etc/suricata/suricata.yaml
chmod 750 /etc/suricata/

This recommendation verifies that IPS mode is enabled on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify IPS mode is enabled
grep -A 5 'af-packet\|nfqueue\|ips-mode' /etc/suricata/suricata.yaml | head -20
suricata --build-info | grep NFQueue

# Enable IPS mode with NFQueue
# In suricata.yaml:
# nfqueue:
#   mode: repeat
#   repeat-mark: 1
#   repeat-mask: 1
# Add iptables rules:
iptables -I FORWARD -j NFQUEUE --queue-num 0
iptables -I INPUT -j NFQUEUE --queue-num 0

This recommendation verifies that rule sources are configured and auto-updated on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check rule sources and update configuration
suricata-update list-sources
ls -la /var/lib/suricata/rules/
grep 'default-rule-path' /etc/suricata/suricata.yaml

# Configure rule sources and auto-update
suricata-update enable-source et/open
suricata-update enable-source oisf/trafficid
suricata-update
# Add cron for automatic updates:
# 0 3 * * * suricata-update && suricatasc -c reload-rules

This recommendation verifies that EVE JSON logging is enabled with all event types on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify EVE JSON logging is enabled
grep -A 20 'eve-log:' /etc/suricata/suricata.yaml | head -30

# Enable EVE JSON logging
# In suricata.yaml:
# outputs:
#   - eve-log:
#       enabled: yes
#       filetype: regular
#       filename: eve.json
#       types:
#         - alert
#         - http
#         - dns
#         - tls
#         - files
#         - flow

This recommendation verifies that log rotation is configured on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check log rotation configuration
cat /etc/logrotate.d/suricata
ls -la /var/log/suricata/

# Configure log rotation
cat > /etc/logrotate.d/suricata <<'EOF'
/var/log/suricata/*.log /var/log/suricata/*.json {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    postrotate
        systemctl reload suricata
    endscript
}
EOF

This recommendation verifies that TLS inspection with JA3 fingerprinting is enabled on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify TLS inspection settings
grep -A 15 'app-layer:' /etc/suricata/suricata.yaml | grep -A 10 'tls:'

# Configure TLS protocol detection
# In suricata.yaml:
# app-layer:
#   protocols:
#     tls:
#       enabled: yes
#       detection-ports:
#         dp: 443
#       ja3-fingerprints: auto

This recommendation verifies that critical protocol parsers are enabled on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check protocol detection settings
grep -A 30 'app-layer:' /etc/suricata/suricata.yaml | grep -E 'enabled|detection-ports'

# Enable critical protocol parsers
# In suricata.yaml under app-layer.protocols:
# http:
#   enabled: yes
# dns:
#   enabled: yes
# smtp:
#   enabled: yes
# ssh:
#   enabled: yes
# ftp:
#   enabled: yes

This recommendation verifies that HOME_NET is properly defined on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify HOME_NET is properly defined
grep 'HOME_NET\|EXTERNAL_NET' /etc/suricata/suricata.yaml | head -5

# Define HOME_NET accurately
# In suricata.yaml:
# vars:
#   address-groups:
#     HOME_NET: '[10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16]'
#     EXTERNAL_NET: '!$HOME_NET'

This recommendation verifies that community-id is enabled for log correlation on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if community-id is enabled for correlation
grep 'community-id' /etc/suricata/suricata.yaml

# Enable community-id for log correlation
# In suricata.yaml:
# outputs:
#   - eve-log:
#       community-id: true
#       community-id-seed: 0

This recommendation verifies that stream engine checksum validation is enabled on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify stream engine settings
grep -A 20 'stream:' /etc/suricata/suricata.yaml | head -25

# Configure stream engine for security
# In suricata.yaml:
# stream:
#   memcap: 256mb
#   checksum-validation: yes
#   reassembly:
#     memcap: 512mb
#     depth: 1mb
#     toserver-chunk-size: 2560
#     toclient-chunk-size: 2560

This recommendation verifies that defrag engine is properly configured on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check defrag engine settings
grep -A 10 'defrag:' /etc/suricata/suricata.yaml

# Configure defrag engine
# In suricata.yaml:
# defrag:
#   memcap: 64mb
#   hash-size: 65536
#   trackers: 65535
#   max-frags: 65535
#   prealloc: yes
#   timeout: 60

This recommendation verifies that Suricata is running the latest stable version on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Suricata version
suricata --build-info | head -5
suricata -V

# Update Suricata to latest stable
apt-get update && apt-get install --only-upgrade suricata
# Or from PPA:
add-apt-repository ppa:oisf/suricata-stable
apt-get update && apt-get install suricata

This recommendation verifies that live rule reloading is configured on the Suricata intrusion detection/prevention system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Suricata intrusion detection/prevention system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify rule reload without restart
suricatasc -c reload-rules
suricatasc -c uptime

# Configure live rule reloading
# Ensure unix-command socket is enabled:
# In suricata.yaml:
# unix-command:
#   enabled: yes
#   filename: /var/run/suricata/suricata-command.socket
# Reload rules without restart:
suricatasc -c reload-rules