# example suricata.yaml snippet
alert-http:
  enabled: yes
pcap-file:
  - /var/log/suricata/alert.pcap

rule-files:
  - local.rules

alert tcp any any -> $HOME_NET 80 (msg:"Possible HTTP flood"; flow:established; threshold:type both, track by_src, count 100, seconds 10; sid:1000001;)

policy id 1001:
  source: any
  destination: server_vip
  application: HTTP, HTTPS
  action: allow
  inspect: yes
  profile:
    dpi: enabled
    bot-protection: enabled
    tls-decrypt: enabled

# sketch: feature extraction for flow
features = [
  flow.packet_count,
  flow.byte_count,
  flow.duration,
  flow.syn_count,
  flow.fin_count
]
model.predict(features)

# 安装Elasticsearch
sudo apt update
sudo apt install elasticsearch

# 启动Elasticsearch
sudo systemctl enable elasticsearch
sudo systemctl start elasticsearch

# 验证安装
curl -X GET "localhost:9200/"

# 安装Logstash
sudo apt install logstash

# 配置Logstash处理Suricata日志
sudo nano /etc/logstash/conf.d/suricata.conf

input {
  file {
    path => "/var/log/suricata/eve.json"
    type => "suricata"
    codec => "json"
  }
}

filter {
  if [type] == "suricata" {
    mutate { remove_field => ["host"] }
    date {
      match => ["timestamp", "ISO8601"]
    }
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "suricata-%{+YYYY.MM.dd}"
  }
}

# 安装Kibana
sudo apt install kibana

# 启动Kibana
sudo systemctl enable kibana
sudo systemctl start kibana

# 访问Kibana UI： http://localhost:5601

# 安装Suricata
sudo apt update
sudo apt install suricata

# 配置Suricata日志路径
sudo nano /etc/suricata/suricata.yaml

outputs:
  - file:
      enabled: yes
      filename: /var/log/suricata/eve.json
      types:
        - alert
        - dns
        - http
        - tls
        - flow

alert http any any -> $HOME_NET 80 (msg:"Possible HTTP flood"; flow:established; threshold:type both, track by_src, count 100, seconds 10; sid:1000001;)

# 创建一个DDoS攻击检测的规则
sudo iptables -A INPUT -p tcp --syn --dport 80 -m limit --limit 10/s -j ACCEPT
sudo iptables -A INPUT -p tcp --syn --dport 80 -j DROP

# 创建一个简单的自动响应脚本
sudo nano /usr/local/bin/ddos_block.sh

#!/bin/bash
# 检查Suricata日志中的DDoS攻击，自动屏蔽源IP
cat /var/log/suricata/eve.json | grep "DDoS attack" | jq -r '.src_ip' | while read ip
do
  iptables -A INPUT -s $ip -j DROP
done

# 使用crontab每小时执行一次脚本
sudo crontab -e

0 * * * * /usr/local/bin/ddos_block.sh

PUT _watcher/watch/suricata-ddos-watch
{
  "trigger": {
    "schedule": {
      "interval": "10s"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": ["suricata-*"],
        "body": {
          "query": {
            "match": {
              "alert.msg": "Possible HTTP flood"
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "found": {
        "gt": 0
      }
    }
  },
  "actions": {
    "email_admin": {
      "email": {
        "to": ["admin@example.com"],
        "subject": "Suricata DDoS Alert",
        "body": "DDoS attack detected in the last 10 seconds. Please check the logs."
      }
    }
  }
}