SuricataAE - Suricata Alerting in Elastic

It's always a special day when we get to share! Introducing SuricataAE, a Watcher for Elasticsearch that sends e-mail alerts based on Suricata findings.

"Where's my e-mail alert?"

If you do any deployment of Suricata in any organization and if you could have a penny for every time you heard those magic words, you'd be set for life!

Whether we like it or not, e-mail is not going anywhere and neither are the alarms that should end up in a case management system, ideally one built specifically for security operations.

Calm down, I'm not saying that each alert should be a case or that all events should be an alert, OK? Let's get back on track here.

Until the day where organizations reach a position that can better leverage detection, the best we can do is develop tools that equip them to do the best possible job with what they have.

SuricataAE is an alarm configuration for Elasticsearch. More specially, it's an Elasticsearch Watcher.

The purpose of this Watcher is to look at data that is coming in from Suricata and, based on workflows or conditions we established, send e-mail notifications/alerts to the appropriate teams.

SuricataAE was developed to address some of the problems I mentioned above and eventually it reached a stage where we felt that releasing it could benefit other organizations that are looking into automating some of their interactions with Suricata.

The release of SuricataAE follows an ideology that is absolutely critical to us: responsible use of open source and a commitment to the projects that are so important to us. We're motivated and inspired by the people that are genuinely working towards a better, safer and more responsible information security eco-system and we try our best to be a part of that!

We hope that with this release we can help others in their deployments of Suricata and we're looking forward to comments or feature requests!

Also, a big welcome to the new mascot of the 3CORESec family! 😍

Community Update - 3CORESec Blacklist 📓 🍯

Recently we tweeted about some issues we had with 3CORESec Blacklist , a platform that shares - openly and freely - a subset of the information seen and processed by our honeypot network. While those issues have been addressed, and seeing as significant changes were made to how we monitor the generation of the lists (which is reflected in our status page ) and how we determine if an IP should be listed as an offending IP or not, this felt like a good opportunity to write a bit more about the platform as well as the changes we made. For regular users of Blacklist 📓 the first thing they’ll notice is an increase on the numbers of IPs we include. That is a direct result of the changes we made and the growth of the honeypot network itself. We have not - and will not - ever increase the period for which we query the honeypot network, as we believe anything higher than 24h (as specified in the project page) for IP addresses can quickly fall into a decaying state that adds little value

Detection as Code (DaC) challenges - Introducing Automata

This blog post is the second part of our Detection as Code (DaC) challenges series. You can read part one here . The development process of detections by itself doesn't pose a lot of barriers for security engineering teams, as they are typically done in a lab/controlled environment, but after tuning and deploying rules to a SIEM, the work is only starting. Many things can go wrong after this, and a process of continued and automated testing is crucial. Detection Validation In an ideal (and fictional) world, once the datasets are parsed, normalized, and put into production, detections developed by your team would work forever. Still, the reality is quite different. Maintenance is heavy work that needs to be done frequently - especially if you work on an MSP - but the reality is that the ecosystem lacks tooling and processes to do it proactively. Effectiveness is an important metric and crucial to the successful response of incidents in time, and effectiveness is what we aim to ensu

Trapdoor - The serverless HTTP honeypot

Today we are announcing the release of Trapdoor , our AWS-based serverless honeypot. The idea of a serverless honeytoken isn't new. Adel released his honeyLambda a few years ago and we've been working with it for quite some time. It was because of this experience and the goal of improving on what was already a great idea that we decided to go to the drawing board and see how we would change and tweak the concept. What is it? Trapdoor is a serverless application that can be deployed in any AWS environment. Its goal is to receive HTTP requests with the intent of identifying, and alerting, on its visitors. The URLs generated by Trapdoor can also be referred to as honeytokens . While you can get creative on how to use it, one of the goals of a honeytoken is to be hidden or stored in a "safe" place and, if accessed, fire of an alarm, as access to the token would be considered a compromise or unauthorized access. This example is the passive way of using deception ta