Suricata IP Reputation Configuration Help
-
I had an older Intel Haswell I5 setup with 16gb of DDR3 and figured why not buid a Pfense box since the pc was just sitting there.
Thanks to Lawrence Systems on youtube I was able to follow his pfense installation setup as well as his video on Suricata. I howeve run into an error when under IP Reputation Configuration and I go to check the box, and hit save the page returns an error "Assignment of a 'Categories File' is required when IP reputation is enabled."
I see in the next table below theirs an Assign Category File and click +Add button but I still get the same error and I'm a bit confused.
I'll post 2 pictures. The first picture is with IP Reputation box clicked with me hitting the save button and getting an error. The second picture will be when I click the +Add button.
Thanks for the help in advance.
Link of Lawrence Systems video where clicking the box gave me my error
https://youtu.be/KRlbkG9Bh6I?t=882
-
This might help!
-
I'm also seeing this, I've had pfsense + Suricata running at home for a long time, however I wanted to play with the rep lists and also got a bit confused.
As a test I installed a dev VM with Snort over Suricata & I found most of the menus to be the same with the exception of WAN IP rep was way easier to set up, I'm not sure if this is a bug for a feature difference.
You can see in Snort I just enabled the ET Open rules, ran a sync and then the ruleset appears in the interface settings, I can't get Suricata to do the same
-
Suricata's IP reputation engine works nothing like Snort's. To use IP Reputation in Suricata you either need to manually build your own configuration files (it takes at least two) or subscribe to the very expensive IQRisk package from Proofpoint (formerly Emerging Threats).
You can find configuration information for IP Reputation in Suricata here: https://suricata.readthedocs.io/en/latest/reputation/ipreputation/ip-reputation.html. The link is to version 5.0.1, but 4.1.x works the same way.
The IP REP tab was originally put in place to support users with an IQRisk subscription from Emerging Threats.
-
@bmeeks said in Suricata IP Reputation Configuration Help:
he IP REP tab was originally put in place to s
Thankyou good info
