"Traffic & Attack Map for Suricata" is modified to work with Suricata's eve.json file. It shows the inbound traffic only which includes normal and attack traffic. It is designed for Python 3 and Ubuntu Server 16.04 LTS. It is also designed to install on the box of Suricata.
The map shows "DROP" or "ALERT" when the traffic is dropped or alerted by Suricata. Meanwhile, other traffic will be shown as its nature (Event Type), such as DNS, TLS, FILEINFO and etc.
"Traffic & Attack Map for Suricata" is released under GPLv3 by Samiux.
(1) Working Suricata dedicate server as IDPS on Ubuntu Server
(2) Python 3.x
(3) Web server with websocket function
(4) Redis server
sha256sum fda369bd246048ce883fabb16e085caa022a492a7e188b4f0c99f37ea4bc8bdb attack-map-0.0.1.tar.gz
Step 1 :
sudo apt-get install python3-pip redis-server
sudo pip3 install tornado tornado-redis redis maxminddb
sudo nano /etc/redis/redis.conf
Change from :
Step 2 :
tar -xvzf attack-map-0.0.1.tar.gz
sudo cp -R geoip-attack-map /var/www
Step 3 :
sudo cp attackmap.service /lib/systemd/system/
sudo cp dataserver.service /lib/systemd/system/
sudo systemctl enable attackmap.service
sudo systemctl enable dataserver.service
Step 4 :
sudo nano DataServer.py
Go to :
hq_ip = '188.8.131.52'replace "hq_ip" with your external IP address.
sudo nano trafficline.js
Go to :
var webSock = new WebSocket("ws://192.168.20.180:8888/websocket");
replace the "192.168.20.180" with your Suricata IP.
Go to :
var hqLatLng = new L.LatLng(33.936051, -81.048565);
replace the value of L.LatLng with your location. You can go to http://latitudelongitude.org to find your Latitude and Longitude values.
Then configure your web server to point the root directory to "/var/www/geoip-attack-map/AttackMap". Make sure you have enabled "websocket" module or function on your web server. Meanwhile, the port for the websocket is 8888 by default.
*** Setting up web server to work with this project is out of scope of this guide.
Step 5 :
Since Redis server requires this setting to avoid performance issue, you need to edit the boot parameter in Grub.
sudo nano /etc/default/grub
Step 6 :
Once boot up, you can point your browser to the IP address that you entered in the above steps.
If there is no traffic on the map, it is properly the DataServer.py not working. Restart it is required.
sudo systemctl restart dataserver
*** Please note that it needs time to read the eve.json file from the beginning of the file on every restart.
Please also note that do not refresh or reload the page as it will corrupt the map. You need to restart the browser.
Traffic and Attack Map for Suricata
That's all! See you!