--- title: Scirius on Ubuntu LTS description: Scirius on Ubuntu LTS image: https://www.stamus-networks.com/hubfs/Imported_Blog_Media/AddRuleset-01.png --- [![Stamus-Logo-with-R-color-small](https://www.stamus-networks.com/hubfs/Stamus-Logo-with-R-color-small.png "Stamus-Logo-with-R-color-small")](https://www.stamus-networks.com/?hsLang=en) # Scirius on Ubuntu LTS by [Peter Manev](https://www.stamus-networks.com/blog/author/peter-manev) | May 20, 2014 | [Open Source](https://www.stamus-networks.com/blog/tag/open-source) ![](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/AddRuleset-01.png) The Ubuntu used in this tutorial: > ***root@LTS-64-1:~/opt#uname -a*** > Linux LTS-64-1 3.5.0-45-generic #68~precise1-Ubuntu SMP Wed Dec 4 16:18:46 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux If you have these packages installed you need to remove them so that Scirius would work with the latest python dependencies. **Please be careful** so that this actually does not affect your current running services. It is always best to test first :) > ******root@LTS-64-1:~/opt#***apt-get remove django-tables python-django python-django-south python-git*** Install the needed dependencies: > ******root@LTS-64-1:~/opt#***aptitude install python-pip git*** > *** ***root@LTS-64-1:~/opt#***pip install django django-tables2 South GitPython pyinotify daemon*** Clone the latest version > ******root@LTS-64-1:~/opt#***git clone https://github.com/StamusNetworks/scirius.git*** > *** ***root@LTS-64-1:~/opt#***cd scirius/*** > ******root@LTS-64-1:~/opt/scirius#*** python manage.py syncdb*** Start Scirius > ***root@LTS-64-1:~/opt/scirius#python manage.py runserver*** > Validating models... > Failed to setup thread-interrupt handler. This is usually not critical > 0 errors found > May 20, 2014 - 19:51:27 > Django version 1.6.4, using settings 'scirius.settings' > Starting development server at http://127.0.0.1:8000/ > Quit the server with CONTROL-C. If you need to connect to the server remotely (provide your ip)  - > ***root@LTS-64-1:~/opt/scirius#python manage.py runserver 10.0.10.5:8000*** > Validating models... > Failed to setup thread-interrupt handler. This is usually not critical > 0 errors found > May 20, 2014 - 19:51:58 > Django version 1.6.4, using settings 'scirius.settings' > Starting development server at http://10.0.10.5:8000/ > Quit the server with CONTROL-C. Now lets have a walk through registering and adding a ruleset For example (for the latest stable and dev Suricata) from  http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz since Emerging Threats create, write and distribute specially tuned for Suricata rulesets that make  use of the advanced features of that IDS engine. First we need to add a source:![AddRuleset-1](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/AddRuleset-11-300x103.png?width=300&height=103&name=AddRuleset-11-300x103.png) [![AddRuleset-0](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/AddRuleset-01-300x107.png?width=300&height=107&name=AddRuleset-01-300x107.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/AddRuleset-01.png?hsLang=en)   Then we add a ruleset:   [![AddRuleset-2](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/AddRuleset-21-300x93.png?width=300&height=93&name=AddRuleset-21-300x93.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/AddRuleset-21.png?hsLang=en) We need to edit the ruleset and select the categories we want from that ruleset:   [![AddRuleset-3](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/AddRuleset-31-300x160.png?width=300&height=160&name=AddRuleset-31-300x160.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/AddRuleset-31.png?hsLang=en)   [![AddRuleset-4](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/AddRuleset-41-300x125.png?width=300&height=125&name=AddRuleset-41-300x125.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/AddRuleset-41.png?hsLang=en) Select categories: [![AddRuleset-5](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/AddRuleset-51-300x173.png?width=300&height=173&name=AddRuleset-51-300x173.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/AddRuleset-51.png?hsLang=en) Validate changes: [![AddRuleset-6](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/AddRuleset-61-300x89.png?width=300&height=89&name=AddRuleset-61-300x89.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/AddRuleset-61.png?hsLang=en) If you have already Elasticsearch, Logstash, Kibana installed on the same server, you could do the following -> put in the values as on the picture - except the **host name** - chose the hostname to be exactly as your hostkey in Elasticsearch/Kibana , like in the pics below.   [![hostkey1](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/hostkey1-171x300.png?width=171&height=300&name=hostkey1-171x300.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/hostkey1.png?hsLang=en) [![hostkey2](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/hostkey2-300x137.png?width=300&height=137&name=hostkey2-300x137.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/hostkey2.png?hsLang=en)   Then in Scirius -> [![CreatingSuricata-1](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/CreatingSuricata-1-300x125.png?width=300&height=125&name=CreatingSuricata-1-300x125.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/CreatingSuricata-1.png?hsLang=en) [![CreatingSuricata-2](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/CreatingSuricata-2-300x144.png?width=300&height=144&name=CreatingSuricata-2-300x144.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/CreatingSuricata-2.png?hsLang=en)   Now you should be able to see the hits and which rules are making the most noise :) That's it for a quick intro.   [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png) ](https://www.facebook.com/share.php?u=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2014%2F05%2F20%2Fscirius-on-ubuntu-lts%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png) ](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2014%2F05%2F20%2Fscirius-on-ubuntu-lts%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2014%2F05%2F20%2Fscirius-on-ubuntu-lts%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2014%2F05%2F20%2Fscirius-on-ubuntu-lts%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png) ](mailto:?subject=Check+out+https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2014%2F05%2F20%2Fscirius-on-ubuntu-lts%3Futm_medium%3Dsocial%26utm_source%3Demail&body=Check+out+https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2014%2F05%2F20%2Fscirius-on-ubuntu-lts%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Peter Manev](https://www.stamus-networks.com/hubfs/Stamus_Peter_Square-1.jpg) #### Peter Manev Peter Manev is the co-founder and chief strategy officer (CSO) at Stamus Networks. He is a member of the executive team at Open Network Security Foundation (OISF). Peter has over 20 years of experience in the IT industry, including enterprise-level IT security practice. He is a passionate user, developer, and explorer of innovative open-source security software, and he is responsible for training as well as quality assurance and testing on the development team of Suricata – the open-source threat detection engine. Peter is a regular speaker and educator on open-source security, threat hunting, and network security at conferences and live-fire cyber exercises, such as Crossed Swords, DeepSec, Troopers, DefCon, RSA, Suricon, SharkFest, and others. Peter resides in Gothenburg, Sweden. [**](https://www.linkedin.com/in/peter-manev-64918336/) [** ](https://twitter.com/pevma) ## Schedule a Demo of Clear NDR [![REQUEST A DEMO](https://no-cache.hubspot.com/cta/default/6344338/a3da5fbf-412c-4e3f-a140-f6f33ed8cc5f.png)](https://cta-redirect.hubspot.com/cta/redirect/6344338/a3da5fbf-412c-4e3f-a140-f6f33ed8cc5f) ## Related posts [![Suricata Language Server 2.0 Now Available from Stamus Networks](https://www.stamus-networks.com/hubfs/SN-SLS-2-Blog-Featured.jpg) ](https://www.stamus-networks.com/blog/suricata-language-server-2.0?hsLang=en) ### [Suricata Language Server 2.0: Major Update with Workspace Intelligence](https://www.stamus-networks.com/blog/suricata-language-server-2.0?hsLang=en) We're excited to announce version 2.0 of the Suricata Language Server, featuring workspace-wide... [![Suricata Language Server 1.3.0: Automated PCAP Testing, Multi-Version Support, and Syntax Highlighting](https://www.stamus-networks.com/hubfs/SLS-1.3-18-Dec-2025.jpg) ](https://www.stamus-networks.com/blog/suricata-language-server-1.3-automated-pcap-testing-and-multi-version-support?hsLang=en) ### [Suricata Language Server 1.3.0: Automated PCAP Testing, Multi-Version Support, and Syntax Highlighting](https://www.stamus-networks.com/blog/suricata-language-server-1.3-automated-pcap-testing-and-multi-version-support?hsLang=en) [Suricata Language Server](https://www.stamus-networks.com/suricata-language-server?hsLang=en) 1.3.0 is now available and it surfs on the concept of magic comment... [![](https://www.stamus-networks.com/hubfs/SLS-1.1.0-13-Nov-2025.jpg) ](https://www.stamus-networks.com/blog/suricata-language-server-1.1.0-reduces-installation-requirements-with-docker-container-mode?hsLang=en) ### [Suricata Language Server 1.1.0 Reduces Installation Requirements with Docker Container Mode](https://www.stamus-networks.com/blog/suricata-language-server-1.1.0-reduces-installation-requirements-with-docker-container-mode?hsLang=en) Writing and validating Suricata signatures shouldn't require wrestling with complex installation... [![Stamus-Logo-with-R-white](https://www.stamus-networks.com/hs-fs/hubfs/Stamus-Logo-with-R-white.png?width=2000&height=536&name=Stamus-Logo-with-R-white.png "Stamus-Logo-with-R-white")](https://www.stamus-networks.com/?hsLang=en) ABOUT STAMUS® NETWORKS Stamus Networks is the network intelligence foundation for AI-powered security operations and the creator of the Clear NDR® system. Built on Suricata, the world's leading open-source network security engine, Clear NDR transforms raw network traffic into actionable security insights with unmatched transparency, customization, and effectiveness. Designed to close visibility gaps and reduce alert fatigue, Clear NDR is trusted by leading financial institutions, government agencies, and has been battle-tested over ten years in NATO's largest cybersecurity exercises. Stamus Networks empowers security teams with greater control, fewer false positives, faster response times, and a more responsive, open approach than legacy vendors. - [**](https://www.linkedin.com/company/stamus-networks) - [**](https://twitter.com/StamusN/) - [**](https://www.youtube.com/Stamus-Networks) - [* *](https://discord.gg/JUMSU9uA) - Paris, FranceIndianapolis, USA **[contact@stamus-networks.com](mailto:contact@stamus-networks.com) [Privacy](https://www.stamus-networks.com/privacy-policy?hsLang=en) © 2014-2026 Stamus Networks, Inc. All rights Reserved.