sudo yum -y install gcc libpcap-devel pcre-devel libyaml-devel file-devel \
zlib-devel jansson-devel nss-devel libcap-ng-devel libnet-devel tar make \
libnetfilter_queue-devel lua-devel

wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz
tar -zxf LuaJIT-2.0.5.tar.gz
cd LuaJIT-2.0.5/
sudo make && make install

vim /etc/ld.so.conf
#添加如下路径，保存退出
/usr/local/lib
#运行如下命令加载
sudo ldonfig

#安装基本库
yum install numactl-devel

#编译安装PF_RING之前需要卸载原来的网卡驱动，卸载之前使用ethtool命令查看当前网卡的类型和驱动版本
ethtool -i eth0
lsmod | grep igb
rmmod igb
#Tips：该操作可能会造成网络无法连接，所以需要现场进行操作，避免使用ssh远程

git clone https://github.com/ntop/PF_RING/
cd PF_RING/
make #直接在跟目录下面make,进行全部编译
cd PF_RING/kernel
make
sudo make install

#最好设置一下，官方解释是2的性能最好，但是有大神测试后发现差别并不是很大
insmod pf_ring.ko transparent_mode=1

#编译安装PF_RING所需依赖库
cd PF_RING/userland/lib
./configure
make
sudo make install

#卸载原来的libpqcap
rpm -qa libpcap #查看安装的libpcap，如果有libpcap则强制卸载
rpm --nodeps -e libpcap

#安装PF_RING的libpcap
cd PF_RING-dev/userland/libpcap
./configure
make
sudo make install

#编译网卡驱动
cd PF_RING/drivers/intel/igb/igb-5.3.5.18-zc/src
sudo insmod igb.ko #安装pf_ring网卡驱动
sudo modprobe igb #只能载入/lib/modules/<kernel ver>/中模块

cd PF_RING/userland/example
make
./pfcount -i eth0 #测试捕获eth0的数据报文

#安装依赖
yum install cmake ragel libtool python-devel GyeoIP-devel
yum install boost boost-devel boost-doc
yum install libquadmath libquadmath-devel bzip2-devel
#boost不需要编译安装，如果通过系统包管理工具(yum/apt-get)安装的，版本无法满足版本需要，则需要下载源码包，解压后执行类似
wget http://downloads.sourceforge.net/project/boost/boost/1.60.0/boost_1_60_0.tar.gz
tar xvzf boost_1_60_0.tar.gz
cd boost_1_60_0/
./bootstrap.sh --prefix=/tmp/boost-1.60
#开始编译，编译的过程有点慢
./b2 install

#安装hyperscan
git clone https://github.com/intel/hyperscan
mkdir build
cd build
cmake -DBUILD_STATIC_AND_SHARED=1 -DBOOST_ROOT=/tmp/boost-1.60 
#开始安装
make
make install

vim /etc/ld.so.conf
#添加如下路径，保存退出
/usr/local/lib64
#运行如下命令加载
sudo ldonfig

wget https://www.openinfosecfoundation.org/download/suricata-4.1.3.tar.gz
tar -xvzf suricata-4.1.3.tar.gz
cd suricata-4.1.3
#编译时可用的参数比较多，要根据自己的需求增加相关编辑参数。参见下文<./configure常见参数作用简单说明>
#我的编译命令如下：
./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --enable-pfring --with-libpfring-includes=/usr/local/pfring/include
--with-libpfring-libraries=/usr/local/pfring/lib --enable-geoip --enable-luajit --with-libluajit-includes=/usr/local/include/luajit-2.0/ 
--with-libluajit-libraries=/usr/local/lib/ --with-libhs-includes=/usr/local/include/hs/ --with-libhs-libraries=/usr/local/lib/ --enable-profiling

./configure常见参数作用简单说明：

使用./configure --help可查看各个参数的说明，其中常见的编译参数如下：

--prefix=/usr/ #Suricata 安装在/usr/bin/.默认安装在/usr/local/
--sysconfdir=/etc #Suricata配置文件存在/etc/suricata/,默认存在 /usr/local/etc/
--localstatedir=/var #设置Suricata日志放在 /var/log/suricata/.默认在 /usr/local/var/log/suricata
--enable-lua #启用Lua支持检测和输出
--enable-geopip #启用GeoIP支持检测
--enable-rust #启用实验Rust支持
--enable-profiling #启用性能分析
--enable-nfqueue #为内联IDP(启用NFQueue支持)启用NFQueue支持，一般开启Suricata的IPS模式时使用

# 加入PF_RING支持
--enable-pfring #启用本机Pf_Ring的支持
--with-libpfring-includes #libpfring的目录
--with-libpfring-libraries #libpfring的库目录

#Lua主要用来编写规则
--enable-luajit #启用Luajit(C语言编写的Lua代码解析器)支持
--with-libluajit-includes #libluajit的目录
--with-libluajit-libraries #libluajit的库目录

#使用scan(一个高性能的多重正则表达式匹配库)时，所需的库
--with-libhs-includes #libhs的目录
--with-libhs-libraries #libhs的库目录

--with-libnss-libraries #libnss的目录
--with-libnss-includes #libnss的库目录

--with-libnspr-libraries #libnspr的目录
--with-libnspr-includes #libnspr的库目录

make
sudo make install
sudo make install-conf

##
## Step 1: inform Suricata about your network
##

vars:
  # more specific is better for alert accuracy and performance
  address-groups:
    #HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
    #配置内网网段
    HOME_NET: "[192.168.0.0/16,10.0.0.0/16]"
    #HOME_NET: "[192.168.0.0/16]"
    #HOME_NET: "[10.0.0.0/8]"
    #HOME_NET: "[172.16.0.0/12]"
    #HOME_NET: "any"

    EXTERNAL_NET: "!$HOME_NET"
    #EXTERNAL_NET: "any"

    HTTP_SERVERS: "$HOME_NET"
    SMTP_SERVERS: "$HOME_NET"
    SQL_SERVERS: "$HOME_NET"
    DNS_SERVERS: "$HOME_NET"
    TELNET_SERVERS: "$HOME_NET"
    AIM_SERVERS: "$EXTERNAL_NET"
    DC_SERVERS: "$HOME_NET"
    DNP3_SERVER: "$HOME_NET"
    DNP3_CLIENT: "$HOME_NET"
    MODBUS_CLIENT: "$HOME_NET"
    MODBUS_SERVER: "$HOME_NET"
    ENIP_CLIENT: "$HOME_NET"
    ENIP_SERVER: "$HOME_NET"

  port-groups:
    HTTP_PORTS: "80"
    SHELLCODE_PORTS: "!80"
    ORACLE_PORTS: 1521
    SSH_PORTS: "[22,63501,57891]"
    DNP3_PORTS: 20000
    MODBUS_PORTS: 502
    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
    FTP_PORTS: 21
......
......
......
#开一些协议解析的字段，保存更详细的日志，便于溯源#
outputs:
  # a line based alerts log similar to Snort's fast.log
  - fast:
      enabled: yes
      filename: fast.log
      append: yes
      #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  # Extensible Event Format (nicknamed EVE) event log in JSON format
  - eve-log:
      enabled: yes
      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
      filename: eve.json
......
......
......
types:
        - alert:
            payload: yes             # enable dumping payload in Base64
            # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
            payload-printable: yes   # enable dumping payload in printable (lossy) format
            packet: yes              # enable dumping of packet (without stream segments)
            # http-body: yes           # enable dumping of http body in Base64
            http-body-printable: yes # enable dumping of http body in printable format
            # metadata: no             # enable inclusion of app layer metadata with alert. Default yes

            # Enable the logging of tagged packets for rules using the
            # "tag" keyword.
            tagged-packets: yes
        - http:
            extended: yes     # enable this for extended logging information
            # custom allows additional http fields to be included in eve-log
            # the example below adds three additional fields when uncommented
            custom: [Accept-Encoding, Accept-Language, Authorization,cookie,origin,server]
        - dns:
            # This configuration uses the new DNS logging format,
            # the old configuration is still available:
            # http://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html#eve-extensible-event-format
            # Use version 2 logging with the new format:
            # DNS answers will be logged in one single event
            # rather than an event for each of it.
            # Without setting a version the version
            # will fallback to 1 for backwards compatibility.
            version: 2

            # Enable/disable this logger. Default: enabled.
            enabled: yes

            # Control logging of requests and responses:
            # - requests: enable logging of DNS queries
            # - responses: enable logging of DNS answers
            # By default both requests and responses are logged.
            requests: yes
            responses: yes

            # Format of answer logging:
            # - detailed: array item per answer
            # - grouped: answers aggregated by type
            # Default: all
            #formats: [detailed, grouped]

            # Answer types to log.
            # Default: all
            types: [a, aaaa, cname, mx, ns, ptr, txt]
        - tls:
            extended: yes     # enable this for extended logging information
            # output TLS transaction where the session is resumed using a
            # session id
            #session-resumption: no
            # custom allows to control which tls fields that are included
            # in eve-log
            #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3]
        - files:
            force-magic: no   # force logging magic on all logged files
            # force logging of checksums, available hash functions are md5,
            # sha1 and sha256
            #force-hash: [md5]
        #- drop:
        #    alerts: yes      # log alerts that caused drops
        #    flows: all       # start or all: 'start' logs only a single drop
        #                     # per flow direction. All logs each dropped pkt.
        - smtp:
            extended: yes # enable this for extended logging information
            # this includes: bcc, message-id, subject, x_mailer, user-agent
            # custom fields logging from the list:
            #  reply-to, bcc, message-id, subject, x-mailer, user-agent, received,
            #  x-originating-ip, in-reply-to, references, importance, priority,
            #  sensitivity, organization, content-md5, date
            custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
 ......
 ......
 ......
 #规则这块使用suricata-update管理，相关suricata.yaml文件的配置参见0x04#

# Runmode the engine should use. Please check --list-runmodes to get the available
# runmodes for each packet acquisition method. Defaults to "autofp" (auto flow pinned
# load balancing).
runmode: workers

# packet size (MTU + hardware header) on your system.
default-packet-size: 1522

# Defrag settings:

defrag:
  memcap: 512mb
  hash-size: 65536
  trackers: 65535 # number of defragmented flows to follow
  max-frags: 65535 # number of fragments to keep (higher than trackers)
  prealloc: yes
  timeout: 30

flow:
  memcap: 1gb
  hash-size: 1048576
  prealloc: 1048576
  emergency-recovery: 30
  #managers: 1 # default to one flow manager
  #recyclers: 1 # default to one flow recycler thread

flow-timeouts:

  default:
    new: 3
    established: 30
    closed: 0
    bypassed: 10
    emergency-new: 10
    emergency-established: 10
    emergency-closed: 0
    emergency-bypassed: 50
  tcp:
    new: 6
    established: 100
    closed: 12
    bypassed: 100
    emergency-new: 1
    emergency-established: 5
    emergency-closed: 2
    emergency-bypassed: 50
  udp:
    new: 3
    established: 30
    bypassed: 100
    emergency-new: 3
    emergency-established: 10
    emergency-bypassed: 50
  icmp:
    new: 3
    established: 30
    bypassed: 100
    emergency-new: 1
    emergency-established: 10
    emergency-bypassed: 50

stream:
  memcap: 12gb
  checksum-validation: no      # reject wrong csums
  prealloc-sesions: 500000     #per thread
  midstream: true
  asyn-oneside: true
  inline: no                  # auto will use inline mode in IPS mode, yes or no set it statically
  reassembly:
    memcap: 20gb
    depth: 12mb                  # reassemble 1mb into a stream
    toserver-chunk-size: 2560
    toclient-chunk-size: 2560
    randomize-chunk-size: yes
    #randomize-chunk-range: 10
    #raw: yes
    #segment-prealloc: 2048
    #check-overlap-different-data: true

# PF_RING configuration. for use with native PF_RING support
# for more info see http://www.ntop.org/products/pf_ring/
pfring:
  - interface: eth0
    # Number of receive threads. If set to 'auto' Suricata will first try
    # to use CPU (core) count and otherwise RSS queue count.
    threads: 16

    # Default clusterid.  PF_RING will load balance packets based on flow.
    # All threads/processes that will participate need to have the same
    # clusterid.
    cluster-id: 99

    # Default PF_RING cluster type. PF_RING can load balance per flow.
    # Possible values are cluster_flow or cluster_round_robin.
    cluster-type: cluster_flow

    # bpf filter for this interface
    #bpf-filter: tcp

libhtp:
         default-config:
           personality: IDS

           # Can be specified in kb, mb, gb.  Just a number indicates
           # it's in bytes.
           request-body-limit: 12mb
           response-body-limit: 12mb

           # inspection limits
           request-body-minimal-inspect-size: 32kb
           request-body-inspect-window: 4kb
           response-body-minimal-inspect-size: 40kb
           response-body-inspect-window: 16kb

# 列出suricata-update支持的所有的规则源
suricata-update list-sources
# 启用一个规则集（我这边启用的是ET的规则集）
suricata-update enable-source et/open

# 规则下载和更新
suricata-update

suricata-update --disable-conf /etc/suricata/disable.conf

ps -ef | grep suricata|grep -v grep
kill -9 id
rm -f /var/run/suricata.pid

wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.7.0-linux-x86_64.tar.gz
tar -zxvf filebeat-6.7.0-linux-x86_64.tar.gz
cd filebeat-6.7.0-linux-x86_64/
vim filebeat.yml

#=========================== Filebeat inputs =============================

filebeat.inputs:
- type: log
  enabled: true
  paths:
  - /var/log/suricata/eve.json
  json.keys_under_root: true
  json.overwrite_keys: true
...
...
...
#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  #hosts: ["localhost:5044"]
  hosts: ["10.8.2.15:50007"]

# -d "publish" 启用对指定选择器的调试，显示所有“publish”相关的消息
./filebeat -e -c filebeat.yml -d "publish"

nohup ./filebeat -e -c filebeat.yml >/dev/null 2>&1 &

ps -ef | grep filebeat
kill -9  进程号

filter {
  if [type] == "suricata_log" {
    date {
    match => [ "timestamp", "ISO8601" ]
    }
    ruby {
      code => "
        if event.get('[event_type]') == 'fileinfo'
        event.set('[fileinfo][type]', event.get('[fileinfo][magic]').to_s.split(',')[0])
        end
        "
      }

    ruby {
      code => "
        if event.get('[event_type]') == 'alert'
        sp = event.get('[alert][signature]').to_s.split(' group ')
        if (sp.length == 2) and /\A\d+\z/.match(sp[1])
            event.set('[alert][signature]', sp[0])
        end
        end
        "
      }
  }

  if [src_ip]  {
    geoip {
      source => "src_ip"
      target => "geoip"
      #database => "/opt/logstash/vendor/geoip/GeoLiteCity.dat"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    }
    mutate {
      convert => [ "[geoip][coordinates]", "float" ]
    }
    if ![geoip.ip] {
      if [dest_ip]  {
        geoip {
        source => "dest_ip"
        target => "geoip"
        #database => "/opt/logstash/vendor/geoip/GeoLiteCity.dat"
        add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
        add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
        }
        mutate {
        convert => [ "[geoip][coordinates]", "float" ]
        }
      }
    }
  }
}
#添加ES的hosts
output {
  elasticsearch {
    hosts => "localhost:9200"
  }
}

POST logstash-suricata_log-*/_delete_by_query
{
  "query": {
    "match": {
      "alert.signature": "SURICATA STREAM 3way handshake wrong seq wrong ack"
    }
  }
}

POST logstash-suricata_log-*/_delete_by_query?wait_for_completion=false
{
  "query": {
    "match": {
      "alert.signature": "SURICATA STREAM bad window update"
    }
  }
}