HackBlue

Tools · Workbench

Network IDS and detection as code

Lessons on Suricata and sigma-cli: replaying captures through an IDS, writing and tuning local rules, and converting and testing Sigma rules in CI.

  • 4 lessons
  • 45 min of reading
  • 2 topics
Start with lesson 1All workbenches

Detections are code: they have inputs, expected outputs, and bugs. These lessons treat Suricata rules and Sigma rules that way, with sample captures and log lines that prove a rule fires and pull-request checks that keep it working.

Every exercise runs on saved lab captures and sample logs, so results repeat exactly.

Suricata

2 lessons

  1. 01Suricata offline: run a lab capture through the IDS and read eve.jsonReplay a saved lab pcap through Suricata with the ET Open ruleset, then use jq on eve.json to read alerts alongside the DNS, TLS, and flow records that explain them.11 min
  2. 02Suricata local rules: write one for your network and tune a noisy oneWrite a local Suricata rule that flags DNS lookups of a retired internal domain, test it against a lab capture, and suppress a noisy ET rule for one known host with a threshold entry.12 min

sigma-cli

2 lessons

  1. 01sigma-cli: convert one detection into Splunk and Microsoft Sentinel queriesInstall sigma-cli and its backend plugins, convert a Sigma rule for suspicious certutil downloads into SPL and KQL, and check the field mappings each pipeline applied.11 min
  2. 02Detection as code: lint and convert a Sigma rules repository in CIRun sigma check and a conversion step on every pull request to a detection repository, so broken YAML, missing fields, and rules that no longer convert are caught before they reach the SIEM.11 min