BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.devconf.info//devconf-cz-2025//talk//KYHCQZ
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-devconf-cz-2025-KYHCQZ@pretalx.devconf.info
DTSTART;TZID=CET:20250614T101500
DTEND;TZID=CET:20250614T113500
DESCRIPTION:This session offers a practical introduction to Suricata\, an o
 pen-source Network Intrusion Detection and Intrusion Prevention System\, f
 ocusing on its role in detecting and mitigating network threats. Through a
  series of practical exercises\, participants will gain insights into the 
 fundamentals of network security and how Suricata can be used to secure th
 e networks.\n\nAttendees will face a series of exercises that enable them 
 to evaluate network traffic and identify threats and anomalies. The worksh
 op gives an opportunity to explore Suricata's features to enhance network 
 security.\n\n-------------------------------------------------------------
 \n# Instructions\n\nTo focus on the essential content of network traffic i
 nspection\, attendees should come with their own laptop where Suricata and
  Evebox systems are ready to use. Ubuntu is the most common OS\, but you c
 an also have another OS or use a virtual machine. You can use native insta
 llation or Docker images (e.g.\, running on macOS or Windows).\n\n## Nativ
 e installation:\n\nHow to install Suricata on Ubuntu/Debian/CentOS...):\nh
 ttps://docs.suricata.io/en/latest/install.html#ubuntu-from-personal-packag
 e-archives-ppa\n\nHow to install Evebox:\nInstallation through APT/RPM rep
 ository is recommended\nhttps://evebox.org/docs/install/\n\n## Docker:\n\n
 ### Environment preparation\n\nHave Docker installed and be in a folder wh
 ich will be a working directory for Suricata and Evebox containers\n```bas
 h\nmkdir -p suricata-demo/{etc\,pcap\,rules\,logs}\ncd suricata-demo/\n```
 \n\n### Rule and config files initialization\n\n```bash\nsudo docker run -
 -rm -it -v $(pwd)/etc:/etc/suricata -v $(pwd)/rules:/var/lib/suricata/rule
 s jasonish/suricata:latest suricata-update --no-reload --no-test && surica
 ta -V\n```\n\n### PCAP_PATH \n\nshould be the only thing to be adjusted to
  the path to PCAP that you want to inspect.\n```bash\nPCAP_PATH=~/Download
 s/HTTP.cap && rm -f $(pwd)/{pcap\,logs}/* && cp $PCAP_PATH "$(pwd)/pcap/" 
 && sudo docker run --rm -v "$(pwd)/pcap:/pcap:ro" -v "$(pwd)/rules:/rules:
 ro" -v "$(pwd)/etc:/etc/suricata:ro" -v "$(pwd)/logs:/var/log/suricata" ja
 sonish/suricata:latest suricata -r /pcap/* -l /var/log/suricata -S /rules/
 suricata.rules -c /etc/suricata/suricata.yaml && sudo docker run --rm -v "
 $(pwd)/logs:/var/log/suricata:ro" -p 5636:5636 jasonish/evebox:latest eveb
 ox oneshot --host 0.0.0.0 /var/log/suricata/eve.json\n```\n\nInstructions 
 might need to be adjusted if you run on Windows - use of a Linux-based VM 
 can be the easiest.\n\n\n# Verify the setup\nYou can verify the installati
 on by:\n- downloading some pcap\, e.g\,. from here: https://wiki.wireshark
 .org/samplecaptures\n- running the pcap through Suricata and Evebox with t
 his command (or use the Docker command):\n`suricata -r |PATH_TO_PCAP| -l /
 tmp/ -S /dev/null -k none && sudo evebox oneshot /tmp/eve.json`\n\nIn the 
 events section of the Evebox local website\, you should now see Suricata e
 vents.
DTSTAMP:20260816T010722Z
LOCATION:A218 (capacity 20)
SUMMARY:Suricata in Action: A Practical Workshop on Network Threat Detectio
 n - Lukáš Šišmiš
URL:https://pretalx.devconf.info/devconf-cz-2025/talk/KYHCQZ/
END:VEVENT
END:VCALENDAR