🛡️ Suricata Cheatsheet
1️⃣ Rule Structure
action protocol src_ip src_port -> dst_ip dst_port (options)
alert tcp $EXTERNAL_NET any -> $HOME_NET 80
(msg:"HTTP test"; sid:1000001; rev:1;)
2️⃣ IP Address Keywords & Lists
| Example | Meaning |
|---|
| any | Any IP address |
| !1.1.1.1 | Every IP except 1.1.1.1 |
| ![1.1.1.1, 1.1.1.2] | Exclude 1.1.1.1 and 1.1.1.2 |
| $HOME_NET | HOME_NET from suricata.yaml |
| [$EXTERNAL_NET, !$HOME_NET] | External network excluding home |
| [10.0.0.0/24, !10.0.0.5] | Subnet except host |
3️⃣ Port Keywords, Ranges & Lists
| Example | Meaning |
|---|
| any | Any port |
| [80,81,82] | Ports 80, 81, 82 |
| [80:82] | Range 80–82 |
| [1024:] | 1024 to max port |
| !80 | All ports except 80 |
| [80:100,!99] | 80–100 excluding 99 |
| [1:80,![2,4]] | 1–80 except 2 and 4 |
4️⃣ Rule Numbering (SID Allocation)
| SID Range | Description |
|---|
| 1000000–1999999 | Custom / Local rules |
| 2000000–2099999 | Emerging Threats (ET Open) |
| 2100000–2103999 | Forked Snort GPL |
| 2200000–2200999 | Decoder events |
| 2210000–2210999 | Stream events |
| 2220000–2299999 | Reserved |
| 2400000–2528999 | Dynamically updated |
| 2800000–2899999 | ET Pro (paid) |
Note: SID is the last keyword (or second-to-last if rev is used).
5️⃣ Rule Actions
| Action | Description |
|---|
| alert | Generate alert |
| drop | Drop packet (IPS) |
| reject | Drop + RST / ICMP |
| pass | Ignore traffic |
6️⃣ Common Rule Options
| Option | Description |
|---|
| msg | Alert message |
| sid | Signature ID |
| rev | Revision |
| classtype | Attack class |
| priority | Severity |
| content | Payload match |
| flow | Traffic direction |
| threshold | Rate limit alerts |
7️⃣ Example Rules
alert tcp $EXTERNAL_NET any -> $HOME_NET 22
(msg:"External SSH attempt"; sid:1000001; rev:1;)
alert tcp any [1024:] -> $HOME_NET any
(msg:"High source port"; sid:1000003; rev:1;)
8️⃣ Default File Locations
| Item | Path |
|---|
| Config | /etc/suricata/suricata.yaml |
| Rules | /var/lib/suricata/rules/ |
| Local rules | local.rules |
| Alerts | /var/log/suricata/eve.json |
9️⃣ Useful Commands
# Validate suricata config
suricata -T -c /etc/suricata/suricata.yaml
# Reload rules
sudo systemctl restart suricata
# Check log
tail -f /var/log/suricata/eve.json
Life is something that no one can teach you. You have to learn it.
Follow me on
