Suricata: Manajemen Rule dengan Oinkmaster - Revision history

Onnowpurbo at 09:26, 9 July 2023

2023-07-09T09:26:29Z

Onnowpurbo at 08:09, 7 July 2023

2023-07-07T08:09:57Z

Onnowpurbo at 07:36, 7 July 2023

2023-07-07T07:36:32Z

Onnowpurbo at 03:43, 30 March 2020

2020-03-30T03:43:12Z

Onnowpurbo: /* Referensi */

2020-03-30T03:42:03Z

Referensi

Onnowpurbo: New page: Rule Management with Oinkmaster It is possible to download and install rules manually, but there is a much easier and quicker way to do so. There are special programs which you can use fo...

2015-05-29T20:55:32Z

New page: Rule Management with Oinkmaster It is possible to download and install rules manually, but there is a much easier and quicker way to do so. There are special programs which you can use fo...

New page

Rule Management with Oinkmaster

It is possible to download and install rules manually, but there is a much easier and quicker way to do so. There are special programs which you can use for downloading and installing rules. There is for example Pulled Pork and Oinkmaster. In this documentation the use of Oinkmaster will be described.

To install Oinkmaster, enter:

sudo apt-get install oinkmaster

There are several rulesets. There is for example Emerging Threats (ET) Emerging Threats Pro and VRT.
In this example we are using Emerging Threats.

Oinkmaster has to know where the rules an be found. These rules can be found at:

http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz

open oinkmaster.conf to add this link by entering:

sudo nano /etc/oinkmaster.conf

Place a # in front of the url that is already there and add the new url like this:

(Close oinkmaster.conf by pressing ctrl x, followed by y and enter. )

The next step is to create a directory for the new rules. Enter:

sudo mkdir /etc/suricata/rules

Next enter:

cd /etc
sudo oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules

In the new rules directory a classification.config and a reference.config can be found. The directories of both have to be added in the suricata.yaml file. Do so by entering:

sudo nano /etc/suricata/suricata.yaml

And add the new file locations instead of the file locations already present, like this:

To see if everything works as pleased, run Suricata:

suricata -c /etc/suricata/suricata.yaml -i wlan0 (or eth0)

You will notice there are several rule-files Suricata tries to load, but are not available. It is possible to disable those rule-sets in suricata.yaml by deleting them or by putting a # in front of them.
To stop Suricata from running, press ctrl c.

Emerging Threats contains more rules than loaded in Suricata. To see which rules are available in your rules directory, enter:

ls /etc/suricata/rules/*.rules

Find those that are not yet present in suricata.yaml and add them in yaml if desired.

You can do so by entering :

sudo nano /etc/suricata/suricata.yaml

If you disable a rule in your rule file by putting a # in front of it, it will be enabled again the next time you run Oinkmaster. You can disable it through Oinkmaster instead, by entering the following:

cd /etc/suricata/rules

and find the sid of the rule(s) you want to disable.

Subsequently enter:

sudo nano /etc/oinkmaster.conf

and go all the way to the end of the file.
Type there:

disablesid 2010495

Instead of 2010495, type the sid of the rule you would like to disable. It is also possible to disable multiple rules, by entering their sids separated by a comma.

If you run Oinkmaster again, you can see the amount of rules you have disabled.
You can also enable rules that are disabled by default. Do so by entering:

ls /etc/suricata/rules

In this directory you can see several rule-sets
Enter for example:

sudo nano /etc/suricata/rules/emerging-malware.rules

In this file you can see which rules are enabled en which are not.
You can not enable them for the long-term just by simply removing the #. Because each time you will run Oinkmaster, the rule will be disabled again.
Instead, look up the sid of the rule you want to enable. Place the sid in the correct place of oinkmaster.config:

sudo nano /etc/oinkmaster.conf

do so by typing:

enablesid: 2010495

Instead of 2010495, type the sid of the rule you would like to to enable. It is also possible to enable multiple rules, by entering their sids separated by a comma.

In oinkmaster.conf you can modify rules. For example, if you use Suricata as inline/IPS and you want to modify a rule that sends an alert when it matches and you would like the rule to drop the packet instead, you can do so by entering the following:

sudo nano oinkmaster.conf

At the part where you can modify rules, type:

modifysid 2010495 “alert” | “drop”

The sid 2010495 is an example. Type the sid of the rule you desire to change, instead.

Rerun Oinkmaster to notice the change.
Updating your rules

If you have already downloaded a ruleset (in the way described in this file), and you would like to update the rules, enter:

sudo oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules

It is recommended to update your rules frequently. Emerging Threats is modified daily, VRT is updated weekly or multiple times a week.

==Referensi==

* https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster

@@ Line 14: / Line 14: @@
 Buka oinkmaster.conf tambahkan link di atas,
-  sudo nano /etc/oinkmaster.conf
+  sudo vi /etc/oinkmaster.conf
-Letakan # di depan URL yang sudah ada, dan tambahkan URL  yang baru.
+Letakan # di depan URL yang sudah ada, dan tambahkan URL  yang baru. Contoh kita menggunakan rules dari emergingthreats.net,
 Langkah selanjutnya membuat directory untuk rules baru, ketik,

@@ Line 4: / Line 4: @@
 Untuk menginstal Oinkmaster, masukkan:
   sudo apt-get install oinkmaster
 Ada beberapa rules. Ada misalnya Emerging Threats (ET) Emerging Threats Pro dan VRT.
-Dalam contoh ini kami menggunakan Ancaman yang Muncul.
+Dalam contoh ini kami menggunakan Ancaman yang Muncul. Oinkmaster harus tahu di mana rules itu bisa ditemukan. Rules ini dapat ditemukan di:
   http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz
-Bukan oinkmaster.conf tambahkan link di atas,
+Buka oinkmaster.conf tambahkan link di atas,
   sudo nano /etc/oinkmaster.conf
@@ Line 30: / Line 27: @@
   sudo oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules
-Oinkmaster harus tahu di mana rules itu bisa ditemukan. Aturan-aturan ini dapat ditemukan di:
+Edit konfigurasi suricata.yaml
   sudo nano /etc/suricata/suricata.yaml
-And add the new file locations instead of the file locations already present, like this:
+tambahkan directory rules yang baru. Cek apakah bisa jalan dengan baik,
-To see if everything works as pleased, run Suricata:
+ suricata -c /etc/suricata/suricata.yaml -i wlan0 (atau eth0)
- suricata -c /etc/suricata/suricata.yaml -i wlan0 (atau eth0)
+Anda akan melihat ada beberapa file aturan yang Suricata coba muat, tetapi tidak tersedia. Dimungkinkan untuk menonaktifkan kumpulan aturan tersebut di suricata.yaml dengan menghapusnya atau dengan meletakkan # di depannya.
-You will notice there are several rule-files Suricata tries to load, but are not available. It is possible to disable those rule-sets in suricata.yaml by deleting them or by putting a # in front of them.
+Untuk menghentikan Suricata berjalan, tekan ctrl c.
-Emerging Threats contains more rules than loaded in Suricata. To see which rules are available in your rules directory, enter:
+Ancaman yang Muncul mengandung lebih banyak aturan daripada yang dimuat di Suricata. Untuk melihat aturan mana yang tersedia di direktori aturan Anda, masukkan:
   ls /etc/suricata/rules/*.rules
-Find those that are not yet present in suricata.yaml and add them in yaml if desired.
+Temukan yang belum ada di suricata.yaml dan tambahkan di yaml jika diinginkan.
-You can do so by entering :
+Anda dapat melakukannya dengan memasukkan:
   sudo nano /etc/suricata/suricata.yaml
-If you disable a rule in your rule file by putting a # in front of it, it will be enabled again the next time you run Oinkmaster. You can disable it through Oinkmaster instead, by entering the following:
+Jika Anda menonaktifkan aturan di file aturan Anda dengan meletakkan # di depannya, itu akan diaktifkan lagi saat Anda menjalankan Oinkmaster lagi. Anda dapat menonaktifkannya melalui Oinkmaster sebagai gantinya, dengan memasukkan yang berikut ini:
   cd /etc/suricata/rules
-and find the sid of the rule(s) you want to disable.
+dan temukan sisi aturan yang ingin Anda nonaktifkan.
-Subsequently enter:
+Selanjutnya masukkan:
   sudo nano /etc/oinkmaster.conf
-and go all the way to the end of the file.
+dan pergi ke akhir file.Ketik ID yang di disable seperti di bawah ini,
   disablesid 2010495
-Instead of 2010495, type the sid of the rule you would like to disable. It is also possible to disable multiple rules, by entering their sids separated by a comma.
+Untuk multiple ID, bisa dilakukan dengan koma antar ID.
-If you run Oinkmaster again, you can see the amount of rules you have disabled.
+Jika Anda menjalankan Oinkmaster lagi, Anda dapat melihat jumlah aturan yang telah Anda nonaktifkan.
-You can also enable rules that are disabled by default. Do so by entering:
+Anda juga dapat mengaktifkan aturan yang dinonaktifkan secara default. Lakukan dengan memasukkan:
   ls /etc/suricata/rules
-In this directory you can see several rule-sets
+Di direktori ini Anda dapat melihat beberapa kumpulan aturan
-Enter for example:
+Masukkan misalnya:
   sudo nano /etc/suricata/rules/emerging-malware.rules
-In this file you can see which rules are enabled en which are not.
+Dalam file ini Anda dapat melihat aturan mana yang diaktifkan dan mana yang tidak.
-You can not enable them for the long-term just by simply removing the #. Because each time you will run Oinkmaster, the rule will be disabled again.
+Anda tidak dapat mengaktifkannya untuk jangka panjang hanya dengan menghapus #. Karena setiap kali Anda akan menjalankan Oinkmaster, aturan tersebut akan dinonaktifkan lagi.
-Instead, look up the sid of the rule you want to enable. Place the sid in the correct place of oinkmaster.config:
+Daripada cari sisi aturan yang ingin Anda aktifkan. Tempatkan sid di tempat oinkmaster.config yang benar:
   sudo nano /etc/oinkmaster.conf
-do so by typing:
+Dengan cara menulis ID yang akan di aneble:
   enablesid: 2010495
-Instead of 2010495, type the sid of the rule you would like to to enable. It is also possible to enable multiple rules, by entering their sids separated by a comma.
+Juga di mungkin mengaktifkan multi-rules, dengan cara memberikan koma antar ID.
-In oinkmaster.conf you can modify rules. For example, if you use Suricata as inline/IPS and you want to modify a rule that sends an alert when it matches and you would like the rule to drop the packet instead, you can do so by entering the following:
+Di oinkmaster.conf Anda dapat mengubah aturan. Misalnya, jika Anda menggunakan Suricata sebagai inline/IPS dan Anda ingin mengubah aturan yang mengirimkan peringatan ketika cocok dan Anda ingin aturan tersebut membuang paket, Anda dapat melakukannya dengan memasukkan yang berikut ini:
   sudo nano oinkmaster.conf
-At the part where you can modify rules, type:
+Di bagian di mana Anda dapat mengubah aturan, ketik:
   modifysid 2010495 “alert” | “drop”
-The sid 2010495 is an example. Type the sid of the rule you desire to change, instead.
+ID 2010495 hanya contoh. Masukan ID yang kita inginkan.
-Rerun Oinkmaster to notice the change.
+Rerun Oinkmaster perhatikan perubahan yang terjadi.
-If you have already downloaded a ruleset (in the way described in this file), and you would like to update the rules, enter:
+==Updating rules==
   sudo oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules
-It is recommended to update your rules frequently. Emerging Threats is modified daily, VRT is updated weekly or multiple times a week.
+Disarankan untuk sering memperbarui rules Anda. Emerging Threat berubah setiap hari, VRT diperbarui setiap minggu atau beberapa kali seminggu.

← Older revision		Revision as of 03:42, 30 March 2020
Line 117:		Line 117:

	* https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster		* https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster
		+
		+	==Pranala Menarik==
		+
		+	* [[Suricata]]
		+	* [[Suricata (software)]]
		+	* [[Suricata: Instalasi di Ubuntu]]
		+	* [[Suricata: Instalasi di Ubuntu 18.04]]
		+	* [[Suricata: Konfigurasi Minimal Ubuntu 18.04]]
		+	* [[Suricata: Test DDoS Attack]]
		+	* [[Suricata: Konfigurasi Dasar]]
		+	* [[Suricata: Manajemen Rule dengan Oinkmaster]]
		+	* [[Suricata: Instalasi Snorby & barnyard2]]

@@ Line 1: / Line 1: @@
-Rule Management with Oinkmaster
+Manajemen Rules dengan Oinkmaster
-It is possible to download and install rules manually, but there is a much easier and quicker way to do so. There are special programs which you can use for downloading and installing rules. There is for example Pulled Pork and Oinkmaster. In this documentation the use of Oinkmaster will be described.
+Dimungkinkan untuk mengunduh dan menginstal aturan secara manual, tetapi ada cara yang jauh lebih mudah dan lebih cepat untuk melakukannya. Ada program khusus yang dapat Anda gunakan untuk mengunduh dan memasang rules. Ada misalnya Pulled Pork dan Oinkmaster. Dalam dokumentasi ini akan dijelaskan penggunaan Oinkmaster.
   sudo apt-get install oinkmaster
-There are several rulesets. There is for example Emerging Threats (ET) Emerging Threats Pro and VRT.
+Ada beberapa rules. Ada misalnya Emerging Threats (ET) Emerging Threats Pro dan VRT.
-In this example we are using Emerging Threats.
+Dalam contoh ini kami menggunakan Ancaman yang Muncul.
-Oinkmaster has to know where the rules an be found. These rules can be found at:
+Oinkmaster harus tahu di mana rules itu bisa ditemukan. Rules ini dapat ditemukan di:
   http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz
-open oinkmaster.conf to add this link by entering:
+Bukan oinkmaster.conf tambahkan link di atas,
   sudo nano /etc/oinkmaster.conf
-Place a # in front of the url that is already there and add the new url like this:
+Letakan # di depan URL yang sudah ada, dan tambahkan URL  yang baru.
-The next step is to create a directory for the new rules. Enter:
+Langkah selanjutnya membuat directory untuk rules baru, ketik,
   sudo mkdir /etc/suricata/rules
-Next enter:
+Selanjutnya, ketik,
   cd /etc
   sudo oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules
-In the new rules directory a classification.config and a reference.config can be found. The directories of both have to be added in the suricata.yaml file. Do so by entering:
+Oinkmaster harus tahu di mana rules itu bisa ditemukan. Aturan-aturan ini dapat ditemukan di:
   sudo nano /etc/suricata/suricata.yaml
@@ Line 39: / Line 38: @@
 To see if everything works as pleased, run Suricata:
-  suricata -c /etc/suricata/suricata.yaml -i wlan0 (or eth0)
+  suricata -c /etc/suricata/suricata.yaml -i wlan0 (atau eth0)
 You will notice there are several rule-files Suricata tries to load, but are not available. It is possible to disable those rule-sets in suricata.yaml by deleting them or by putting a # in front of them.