Menu Close

Connecting Moloch and Suricata

Connecting Moloch and Suricata

  • Authors : Tomáš Mokoš, Miroslav Kohútik

In this article we will show you how to connect network traffic capture tool Moloch with intrusion detection system Suricata.

Installation guides for Moloch and Suricata can be found here and here, respectively.

Moloch archives network traffic to which it provides fast and organized access, however, Moloch does not provide any security measures for said traffic by itself. On the other hand, Suricata IDS surveils the monitored traffic and creates signatures that provide information about threats, but does not provide any GUI to display them.

Since version 1.5 (released on 16.7.2018), Moloch supports a plugin for importing Suricata alerts. Suricata and Moloch must be running on the same machine for the plugin to work. Data generated by Suricata can be accessed in Moloch’s web UI in the Sessions and SPI View tabs. All sessions containing Suricata data can be found by using query suricata.signature == EXISTS! in Moloch’s search bar. This solution does not feature a special Suricata UI inside Moloch, it just adds new fields to Moloch data. To add this plugin, you need to add suricata.so to the list of plugins and specify the path to eve.json file in the Moloch configuration file.

Append the following lines to the Moloch config file located in * /data/moloch/etc/config.ini* :

pluginsDir=/data/moloch/plugins
plugins= suricata.so;
suricataAlertFile=/usr/local/var/log/suricata/eve.json
suricataExpireMinutes=60
Suricata sessions

The Suricata fields should now appear in Sessions and SPI View

Suricata SPI View

Source:

Leave a Reply

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.