This article helps with providing guidelines for installing Suricata-Eve-Unixsocket app in Trisul Network Analytics.

To create a threat signatures that will turn into a powerful frontline alert monitoring system for any enterprise.Usually Suricata show up as IDS alerts in Trisul.

• You can install the app by logging in as admin and selecting Web Admin > Manage > Apps > Suricata via Eve Unixsocket.

• Please install Suricata by running the following command,

add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
apt-get install suricata

• You have to install the Emerging Threats Community which are a set of rules that trisul will listen to.
• Download and install Emerging Threats Open rules into /etc/suricata

#cd /etc/suricata
#wget https://rules.emergingthreats.net/open/suricata-5.0.0/emerging.rules.tar.gz
#tar xf emerging.rules.tar.gz

• locate the 'Outputs' section in /etc/suricata/suricata.yaml enable EVE logging as shown below.

# Extensible Event Format (nicknamed EVE) event log in JSON format
  - eve-log:
      enabled: yes
      filetype: unix_dgram  #regular| 
      filename: suricata_eve.socket

• And, also disable the 'fast.log' in /etc/suricata/suricata.yaml as shown below.

outputs:
  # a line based alerts log similar to Snort's fast.log
  - fast:
      enabled: no
      filename: fast.log
      append: yes
      #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'

Run suricata and set the log directory to the default context run directory using the command,

suricata --user tirsul -l /usr/local/var/lib/trisul-probe/domain0/probe0/context0/run -c /etc/suricata/suricata.yaml -i enp0s25 -D