All about Suricata with Victor Julien

Today Open Source Security is talking to Victor Julian, the founder and lead developer of Suricada. Victor, I'm very excited to have you here. So I guess start, why don't you tell us who you are and let's start with what is Suricada? Because it is an amazing project.

Thank you. Thank you for having me. So yes, my name is Victor Julian. I'm from the Netherlands and currently in Amsterdam, in the Netherlands. I'm leading the development team of Surakada for the OASF, the foundation that governs and funds Surakada development. I'm a Dutch citizen and so I've been born and raised here

in the country. Many, many years ago, together with two others from the US, Matt Youngman and Will Matcalf, we got this idea that we could build our own IDS IPS engine, which at the time didn't have a name yet, but we got together and started sort of dreaming about how we might be able to do that. And we were very lucky. We got funding through DHS in the US, and so we set up this foundation

to govern the technology and the development process. And we had seen some examples of open source that was very successful, but was sort of acquired by big companies. And so we wanted to see if we could set it up such that we would protect it against this kind of

sort of takeover or, well, I don't know if that's the correct word, but protected against this corporate influence. And so we set up the foundation to really work with the community. And that's now, I think, 15 years ago or so.

And I think we've done pretty well. Of course, my role is mostly on the technical side. And I tell everyone all the time that on the technical side, I'm never happy, never satisfied.

There's all my list of things that I want to improve is always so long. But yeah, we've been doing I think quite interesting work and so quite happy so far. Yes, it's interesting for sure. So I mean, I don't even know where to start on this one.

I guess let's not dwell on the past too much. But I will say like back when Saracada was created, you're right. There were a bunch of open source projects that all were acquired by a company or something happened to them.

And I feel like Suricata has emerged as the kind of unquestioned open source project in the space of network, IDS, and IPS. So I mean, well done there. I have no doubt the foundation setup you created is what has made that possible.

And obviously as a human existing in this mess of everything, like I'm glad it's there. So tell us what is suricata for anyone who might not be familiar with the project? Yeah, so I think at its heart suricata is a network IDS and IPS engine, which for us means

we're capturing traffic. Let's hold on. What is IDS and IPS for anyone unfamiliar with those terms? Intrusion detection system or intrusion prevention system, although I've always

little taken a bit of issue, I guess, with the S there, the system, because I think Sarkata is more like an engine that's part of a bigger system. And for most people, not the whole thing that they use, right? So it's more like the engine in your car and not the car itself.

And so what it essentially does, it sniffs your traffic or it sits in line in your traffic, tries to make sense of it, rebuilds a state of sort of the talkers on your network, tries to rebuild the state in terms of TCP, in terms of HPP,

DNS, and all that kind of stuff. And then it has a rule language that is essentially a signature language, and that you can apply those signatures against a traffic and race alerts.

But in addition to that, Serkata can provide a very rich stream of metadata that you can then feed to your post-processing pipeline, things like your Alkstag or other tools where you can do higher level analysis and visualizations

and all that. But Seracata is not a visual tool itself. It's just it essentially it reads packets and produces JSON. That's kind of what it is today.

It sounds so simple when you say it that way. Yeah, conceptually it is. The devil is in the details, obviously. It is not simple.

I am very familiar with this process, and it is definitely not simple. And yeah, I mean, I'll say so. I used to work in Elastic.

And I can think of almost no large environments at Suricada wasn't there somewhere. Because everyone would, yeah, they'd stream the data into Elasticsearch and then they'd create their dashboards

and analyze traffic and do thread hunting. And it was amazing, the richness of the data. Okay, so let's talk about the kind of signature aspect. Cause you kind of talked about a lot, no, hold on.

Before we do that, I want to ask the question, like, so what you just described sounds a little bit like a firewall. I actually don't know how you explain this.

How do you explain the firewall versus suricata dichotomy? Sure. So I think in a sense, I see suricata as three or four different modes of operation. The primary one that I think most people are most familiar with is the IDS mode.

So you're sitting on the site, you're sitting on a spam port or a tab, you're getting a copy of the traffic, you're passive, and the sensor analyzes the traffic, produces alerts and other data that you can then act on. Then the other quite common mode is IPS mode.

So in IPS mode, we're essentially doing the same thing, but now we're in line and we can make policy decisions based on the rules. can say this traffic is allowed to pass. This should be blocked.

In the way I describe it, in IPS mode, we are open by default. And we have a rule set that selectively drops things based on signatures of malware or other unwanted traffic. And then in the last version that we released,

eight, we also introduced what we call firewall mode, which is essentially the reverse of the IPS mode. So we start with a default drop policy, nothing passes. And then you have to create a rule set,

like typical firewall, like your IP tables or NF tables, and start allowing traffic to pass through. And so that's sort of the three main modes. And then I guess the fourth is sort of offline analysis

of P-CAP files, which is used quite a lot of well as well. So what we see, for example, the IPS mode