Suricata IDS support - Suricata command 'pcap-file' not found #184
Assignees
Labels
setup
Problems related to Cuckoo3 setup
Comments
|
Thank you @ryanorm for submitting the issue. I will have to look into it and be back with you as soon as I have some answers. |
|
@ryanorm
|
|
The requested files are below. suricata.log I've noticed this morning that after a VM reboot the file permissions of Cuckoo service log: Running |
|
Thank you! |
|
The problem might be that Suricata is not run under Change your # Run Suricata with a specific user-id and group-id:
run-as:
user: cuckoo
group: cuckooLet me know if the issue persists. |
|
@cert-ee-raidar I went ahead and made that change and restarted the suricata and cuckoo services - the same command not found error occured. I then made file permission changes for the Permissions on After a cuckoo service restart the 'pcap-file' command not found error is still occuring. I've attached
Specific contents of |
|
@cert-ee-raidar The suricata docs say the Using the last Cuckoo log example I gave the I've tried a few JSON parsers/validators and this seems to be invalid JSON, replacing single quotes with double quotes resolved this issue.
|
|
Thank you for the extensive amount of information. |
|
Unfortunetly it will take a bit more than few days. Sorry for the wait. |
|
@cert-ee-raidar Thank you for the update. If I have time this week I will look at downgrading Suricata and re-testing. If I have updates I will share them. |
|
@cert-ee-raidar Unfortunatley no progress with the command not found error with Suricata. I've tested Suricata 7.0.7 with the socket file located under Side note - Any permission changes made to Configuring Created folder
Edited Edited |
|
TLDR: I believe the original "pcap-file" command not found error is caused because my Suricata service was not running in "PCAP processing mode" - details below. With one additional change to Suricata's config I was able to submit PCAP files for manual analysis. Cuckoo still needs some changes to make this happen automatically. When running the I believe this is because the suricata service is not running in "PCAP processing mode" as defined in Suricat's documentation here I stopped the Suricata service ( Starting a Suricata process in "PCAP procssing mode"Then when I ran Therefore I think this does give a good answer to the original issue. It might be good advice that Cuckoo deployments do not use Suricata running as a service. Manually processing Cuckoo PCAP files with SuricataHowever when I run the I had to edit Set Running the
Suricata process output: |
|
@cert-ee-raidar I have been able to get Suricata working consistently now, PCAPs are submitted to Suricata and alerts are displayed in the GUI report page.
SolutionCreate a systemd service for running Suricata in "PCAP processing mode" which the main Cuckoo3 service must wait to be running before it scan start. I also moved the Suricata socket file to The Suricata service runs Suricata as the root user but the socket file is accessible to the cuckoo user. I'd welcome any suggestions on how I've written the service file - this is not my strongest area. systemd file for My My My : Log showing execution of the SuricataPcap analysis plugin: Output of Cuckoo3suricata.service showing PCAP processing from Cuckoo: |
|
@ryanorm When I get the chance, I will go over it in practice and then add it to our documentation. Once I have worked through it I will close the issue myself. |
|
I followed the steps laid out by @ryanorm and can confirm everything is working! I have yet to test it with known malware to see how it performs, but that's for another time. |
|
@LM-CT thats great news. I've been running Cuckoo with these steps in place for two weeks and have had stable service start and task execution. @cert-ee-raidar if you need me to generate some documentation for this I will be happy to do so. |
|
@ryanorm Please add the new guide under configuring section You can follow our Contributing guide to get started. It may be a bit raw so suggestions are also welcome. We do net yet have a documenting guide, but the gist of it is:
|
|
An update: After a reboot, the socket file was recreated with @ryanorm And, again, thank you for the detailed guide! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
Which is the latest supported version of Suricata IDS with Cuckoo3?
I have installed Suricata 7.0.7 (latest stable) and I am encountering the following error after analysis tasks finish.
Two log messages specifically mention that the command 'pcap-file' has failed to execute. The relevant config files are below with example task logs.
Cuckoo runs the SuricataPcap plugin after analysis has ended:
Immediately a WARN messgae is thrown as below:
Full log of an example task:
~/.cuckoocwd/conf/processing/suricata.yaml:
Configuration of unix-command in /etc/suricata/suricata.yaml:
The cuckoo user and group own / have RW access to the suricata-command.socket file:
Thinking this could be a permission issue I gave the cuckoo user execution permissions and the issue still occured:
To Reproduce
Install Suricata 7.0.7, enable Suricata in suricata.yaml, reload Cuckoo service.
Expected behavior
Suricata receives the dump.pcap file produced by Cuckoo for analysis.
The text was updated successfully, but these errors were encountered: