Re:- not fetching logs into eve.json of suricata

[Saurabh Pathak]

Hello Team, 

I am try to integrate suricata with wazuh but after all configuration that logs are not into the eve.json file. I am attaching the screenshot of that. Please help

[Pedro Nicolás Gomez]

Hi pathakvsaurabh, sorry for the late response.

In the following link to the Wazuh documentation we explain how to integrate with suricata.

https://documentation.wazuh.com/current/proof-of-concept-guide/integrate-network-ids-suricata.html

Basically the steps to follow are:

• Install Suricata.
• Configure the rules of your interest.
• Configure the Wazuh agent to read Suricata logs file.

Here I also share some articles that could be of your interest.

• https://documentation.wazuh.com/current/learning-wazuh/suricata.html
• https://documentation.wazuh.com/current/proof-of-concept-guide/detect-web-attack-shellshock.html
• https://documentation.wazuh.com/current/proof-of-concept-guide/detect-web-attack-sql-injection.html

I hope it helps.
Best regards,

Pedro Nicolas.