As we have previously written, for all Suricata’s capabilities, building out an enterprise-scale deployment of Suricata with mostly open source tools can be a challenge.
In this fourth entry in the series of blog posts, we review another one of the five ways to improve the scalability of Suricata in an enterprise deployment - Consolidating Suricata Alerts and Logs.
Note: for a more complete review of all five improvements, please check out the white paper, Scaling Suricata for Enterprise Deployment. You can download your copy here >>
A single instance of Suricata deployed as a SELKS installation provides you with a turnkey Suricata intrusion detection and prevention system and NSM platform with the ELK stack to collect, store, and analyze alerts and events, EveBox to correlate flows, archive/comment on events, reporting and pcap download. The SELKS user interface is the Scirius Community Edition which allows an analyst to perform basic incident investigation and basic threat hunting (along with configuration and management of the Suricata ruleset).
But enterprises deploying multiple sensors must find a way to consolidate the logs, events and alerts from those sensors into a “single pane of glass” to efficiently correlate, analyze, search, and gain insights into their overall enterprise network security posture.
Figure 1. Consolidate logs, events and alerts from Suricata sensors to simplify the SOC
This is the function typically provided by a security information and event management system (SIEM), a software system that analyzes log and event data in real time to provide threat monitoring, event correlation and incident response.
The good news is that there are a number of free and open source options to choose from. Three examples of this genre are listed below.
Naturally, the challenges of these open source tools is that no single one of these is capable of solving all your organization’s needs, so you may find yourself augmenting your selection with other open source or commercial tools to get the coverage you need.
Ideally, the network security information detected, collected and logged by the Suricata sensors is combined with other indicators generated by systems such as endpoint detection systems. But at a minimum, all events from Suricata sensors should be consolidated into a single console.
Of course, many commercial options are also available. These tend to be more full-featured and newer offerings include functionality such as advanced analytics, threat intelligence, incident response and user monitoring.
One of the most popular commercial options is Splunk, an open platform for which many security vendors have developed custom apps to optimize their system’s integration into the platform. This particular one bears mentioning in this paper because of the recently introduced Stamus Networks App for Splunk which includes native support for Suricata.
Figure 2. Stamus Networks App for Splunk delivers native support for Suricata in Spunk.
The Stamus Networks App for Splunk allows Splunk Enterprise users to extract information and insights from Suricata sensors. It provides ready-to-use dashboards and reports that expose the IDS and NSM data being collected by Suricata sensors and help those with large Suricata deployments become more productive.
In an earlier blog article we reviewed ways to optimize your sensor placement. Future blog articles will cover the additional three considerations that can help you improve the scalability of Suricata in your enterprise. Here’s the complete list of articles:
If you are interested in exploring this topic further, we recommend the following resources: