Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fsecurity%2Fsuricata.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fsecurity%2Fsuricata.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.) # Integrate Suricata with Coralogix using OpenTelemetry This guide explains how to integrate Suricata with Coralogix using the OpenTelemetry Collector. It leverages the flexibility and vendor-agnostic design of OpenTelemetry for observability pipelines. ## Prerequisites[​](#prerequisites "Direct link to Prerequisites") Before you begin, make sure you have the following: * Suricata installed and configured * OpenTelemetry Collector [installed](https://coralogix.com/docs/docs/opentelemetry/getting-started/.md) ## Install Suricata[​](#install-suricata "Direct link to Install Suricata") ### Debian/Ubuntu[​](#debianubuntu "Direct link to Debian/Ubuntu") ``` sudo add-apt-repository ppa:oisf/suricata-stable sudo apt update sudo apt install suricata -y ``` ### CentOS/RHEL[​](#centosrhel "Direct link to CentOS/RHEL") ``` sudo yum install epel-release -y sudo yum install suricata -y ``` ## Configure Suricata[​](#configure-suricata "Direct link to Configure Suricata") Ensure Suricata writes logs in EVE JSON format, typically to: /var/log/suricata/eve.json The configuration file is located at: /etc/suricata/suricata.yaml Update the outputs section in suricata.yaml: ``` outputs: - fast: enabled: yes filename: /var/log/suricata/eve.json append: yes filetype: json types: - alert - dns - flow - stats ``` ## Install OpenTelemetry[​](#install-opentelemetry "Direct link to Install OpenTelemetry") See the GitHub documentation for installation details: ## OpenTelemetry Collector configuration[​](#opentelemetry-collector-configuration "Direct link to OpenTelemetry Collector configuration") Save the following configuration as /etc/otelcol-contrib/config.yaml: ``` receivers: filelog: start_at: beginning include: - /var/log/suricata/eve.json operators: - type: json_parser id: suricata_json_parser parse_from: body - type: filter id: suricata_alert_filter expr: 'body.event_type == "alert"' exporters: coralogix: domain: "coralogix.com" private_key: "" application_name: "suricata" subsystem_name: "suricata" timeout: 30s service: pipelines: logs: receivers: [ filelog ] exporters: [ coralogix ] ``` Note: Replace `` with your actual Coralogix private key. ## Run the OpenTelemetry Collector[​](#run-the-opentelemetry-collector "Direct link to Run the OpenTelemetry Collector") To start the OpenTelemetry Collector with your configuration: ``` otelcol-contrib --config otel-collector-config.yaml ``` To restart the service if needed: ``` sudo systemctl restart otelcol-contrib ``` Default configuration path: /etc/otelcol-contrib/config.yaml ## Run Suricata in PCAP mode[​](#run-suricata-in-pcap-mode "Direct link to Run Suricata in PCAP mode") ``` sudo suricata -i eth1 -c /etc/suricata/suricata.yaml -v ``` ## Configure AWS traffic mirroring[​](#configure-aws-traffic-mirroring "Direct link to Configure AWS traffic mirroring") ### Create a traffic mirror target[​](#create-a-traffic-mirror-target "Direct link to Create a traffic mirror target") Define where mirrored traffic will be sent (the ENI of the Suricata instance). 1. Go to VPC > Traffic Mirroring > Mirror Targets 2. Click Create traffic mirror target 3. Select the network interface of your Suricata EC2 instance 4. Provide a name and description ### Create a traffic mirror filter[​](#create-a-traffic-mirror-filter "Direct link to Create a traffic mirror filter") Specify the type of traffic to mirror (for example, TCP, UDP, or all). 1. Go to Mirror Filters and click Create filter 2. Add inbound and outbound rules: * Protocol: All or specify (TCP, UDP, etc.) * Port range: Optional * CIDR blocks: 0.0.0.0/0 to capture all, or restrict ### Create a traffic mirror session[​](#create-a-traffic-mirror-session "Direct link to Create a traffic mirror session") Link the source instances to the Suricata target using the filter. 1. Go to Mirror Sessions and click Create session 2. Configure the following: * Source: The ENI of the monitored EC2 instance * Target: The mirror target created earlier * Filter: The mirror filter created earlier * Session Number: Priority if multiple sessions exist * Packet Length: Maximum bytes per packet (default: 100) ## Verify Suricata is receiving traffic[​](#verify-suricata-is-receiving-traffic "Direct link to Verify Suricata is receiving traffic") Once the session is active: * SSH into the Suricata instance * Check interface activity: ``` sudo tcpdump -i eth1 ``` * Verify the correct network interface: ``` ip addr ``` * Check Suricata logs under /var/log/suricata/ to confirm traffic detection ## Completion[​](#completion "Direct link to Completion") If all steps are followed, you should now be receiving Suricata logs in Coralogix. ## Best practices[​](#best-practices "Direct link to Best practices") * Security groups: Allow inbound traffic on Suricata’s listening interface (note: SGs may not apply to mirrored traffic) * Performance: Use Nitro-based instance types (c5, m5) for high throughput * Storage: Ensure adequate EBS storage for logs and packet data * Monitoring: Configure CloudWatch or an external logging system for long-term monitoring and alerting ## Limitations[​](#limitations "Direct link to Limitations") * Mirrored traffic is read-only—Suricata cannot respond or modify packets * Cross-region mirroring is not supported * Traffic mirroring works only with Nitro-based instances for both source and target