Well, as luck would have it, I have rules already downloaded and ready for us
to go
and look at.
We're going to take a look at the Suracotta.rules file real quick and show you
that it's basically
written like Snort or IDS or IPS rule configurations.
Basically what's happening here is that we have alerts or actions being taken
based
on a certain rule set.
Let me pop out and zoom in for you to show you what I'm talking about.
Such as alert IP in any, going to any, any message, Suracotta app layer
mismatch protocol
both directions.
And there's more to that actual rule itself.
But if you're familiar with actual Snort rules, this will make a whole lot of
sense.
Now Snort is something we're going to be diving into later throughout the skill
.
And there are many other Snort courses and skills here on CBT nuggets.
But this is where the magic behind Suracotta starts to come into play here.
Now we can take, let me go back to the terminal window for us real quick inside
of the Suracotta
folder.
And we can say Suracotta -R using our passive capture that we had, that PCAP
file with a
-C now and pointing it to the actual Suracotta YAML that we're going to be
using for our
actual rule set.
Now in case you're wondering that YAML is going to be the configuration file
for Suracotta,
which is why it has a -C and inside of that config file points to the default
rules folder,
which is what we just took a look at.
I wanted to point that out real quick before I got too ahead of myself.
Now here we're going to go ahead and hit enter, run our Cali password.
And this time it's going to run again.
I may have to break and rerun this to, just in case it tries to append the
files that
are already created inside of this folder instead of actually writing to them.
And that's exactly what I did because it did append to them.
And I'm going to go back and take a look at the actual folder itself because
Suracotta
has ran with the YAML attached to it pointing to the rules.
Now if we open up Suracotta.log, you'll notice that it just gives us the actual
log of what
ran.
I wanted to show you that before I forgot.
And we go into the fast.log now.
And we can see here that we have a bunch of different errors pointing up
basically invalid
checksums for Suracotta and those IP addresses going to and from.
So it's starting to match the rules set inside of our YAML configuration file
pointing to
the rules, which is basically a rehash of putting it through snort.
So is all this offline?
Yes.
Is this something that can be done online and through programs like snort?
Absolutely.
We're doing this with as a soft as touch as possible.
Lastly, if we look at the our stats.log file, you can see here that there's a
breakdown
of types of packets along with the values that the packets came up.
So for instance, this last line right here, flow.measure.
If I pop out and zoom in for us real quick, we can see that there were 700 or 7
million
pops of flow dot, MIM use instead of measure.
And we can see that a few lines up there was TCP dot MIM use a lot of lines.
And then we have, let's say line 39 app layer flow HTTP was 20.
So it gives us an idea of what's happening inside of that actual packet capture
that
was taken passively.