Suricata

Suricata is good at spotting attacks and has a built-in IP reputation engine. Use both directions: report the sources of serious alerts, and load the list as reputation data so rules can flag traffic from listed addresses.

Report the sources of serious alerts

Hourly from cron, report every external address behind a severity 1 alert in the last hour of eve.json (needs jq):

since=$(date -d '1 hour ago' +%Y-%m-%dT%H:%M)   # eve.json uses local time
jq -r --arg since "$since" 'select(.event_type=="alert" and .alert.severity==1 and .timestamp >= $since) | .src_ip' \
  /var/log/suricata/eve.json | sort -u | while read -r ip; do
  curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" --data-urlencode "ip=$ip" \
    -d categories=hacking --data-urlencode "comment=Suricata severity 1 alert" >/dev/null
done

Your own and private addresses are refused by the API, but exclude your HOME_NET in the jq filter anyway if your rules alert on outbound traffic.

Flag listed addresses with IP reputation

1. Declare a category in /etc/suricata/iprep/categories.txt:

   1,isipsafe,Listed on isIPsafe

2. Download the list as a reputation file (address, category, score from 1 to 127) hourly:

   curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=csv&confidenceMinimum=25&limit=500000" \
     | awk -F, 'NR>1 {print $1",1,"$2}' > /etc/suricata/iprep/isipsafe.list.new \
     && mv /etc/suricata/iprep/isipsafe.list.new /etc/suricata/iprep/isipsafe.list \
     && suricatasc -c reload-rules

3. Tell Suricata about it in suricata.yaml:

   reputation-categories-file: /etc/suricata/iprep/categories.txt
   default-reputation-path: /etc/suricata/iprep
   reputation-files:
     - isipsafe.list

4. Add a rule to your local rules; the score in the file is the isipsafe confidence:

   alert ip any any -> $HOME_NET any (msg:"Source listed on isIPsafe with confidence 75 or more"; iprep:src,isipsafe,>,74; classtype:misc-attack; sid:9907501; rev:1;)

   In IPS mode, change alert to drop to block them inline.

Rule reloads re-read the reputation files on current Suricata versions; on old releases, restart Suricata after each download.

Need a hand?

If something here does not work with your version of Suricata, or you have improved it, tell us. We update these pages with what people send.

Suricata and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.