Setting up the Barracuda XDR Collector for Barracuda IDS for Linux

The XDR Collector runs as a service in your environment. While the minimum specifications are listed below, the required resources depend on the number of active integrations and the amount of data being processed.

Minimum requirements

To set up the XDR Collector, the minimum requirements are the following:

Operating System

• Ubuntu 22.04 (Recommended)

• For other versions, see the Elastic Agent 8.12.x row in the Elastic Agent table on this page.

Required Endpoint/Port Communication

The XDR Collector must be able to communicate to the following endpoints/ports:

Dedicated Host Requirements

Barracuda IDS/Suricata requires that the collector run in a dedicated host.

Setting up the XDR Collector for Linux for Barracuda IDS

To set up the XDR Collector for Linux, perform the following procedures:

• To install the XDR Collector

• To set up switch port mirroring

• To edit the Suricata configuration

To install the XDR Collector

1. In Barracuda XDR Dashboard, click Infrastructure  > Collectors.

2. In the Policies table, next to the on-prem policy, click Action > Install.

3. Click Linux.

   Open

   

4. Click the copy to clipboard icon to copy the install command to your clipboard.

   Open

   

5. Open a terminal on the appropriate system, paste the command, and run it.

To set up switch port mirroring

Click a link for specific configurations for the following:

• Configuring Port Mirroring on VMWare

• Configuring Port Mirroring on Hyper-V

1. Connect the secondary Ethernet interface on the XDR Collector's host machine to the mirrored port on the switch.

2. Configure the switch to mirror traffic in both directions on all other ports on the switch.

Installing Suricata

To install Suricata, follow the procedure for your environment (below):

• To install Suricata on Ubuntu/Debian

• To install Suricata on CentOS/Rocky/Alma 9.x

To install Suricata on Ubuntu/Debian

1. To run the install script, copy and run the following commands:
   sudo mkdir -p "/usr/local/bin/suricata"
sudo bash -c 'curl -L "https://skout-csd-assets-public.s3.amazonaws.com/suricata/linux/suricata-scripts.tar.gz" | tar -xz -C "/usr/local/bin/suricata"'
sudo find "/usr/local/bin/suricata" -type f -exec chmod +x {} \;
cd /usr/local/bin/suricata
sudo ./install.sh

2. Follow the prompts through the configuration.

Installing and configuring Suricata on CentOS/Rocky/Alma 9.x

To install and configure Suricata on CentOS/Rocky/Alma 9.x, follow the procedures below.

To update system and install prerequisites

• Copy and run the following commands:

sudo dnf update -y
sudo dnf install -y epel-release
sudo dnf install -y curl tar tcpdump

To install Suricata

• Copy and run the following command:
  sudo dnf install -y suricata

To update Suricata rules

• Copy and run the following command:
  sudo suricata-update

To enable the Suricata service

• Copy and run the following command:
  sudo systemctl enable suricata.service

To download and extract the configuration files

• Copy and run the following commands:
  sudo mkdir -p /usr/local/bin/suricata
sudo curl -L "https://skout-csd-assets-public.s3.us-east-1.amazonaws.com/suricata/linux/7.0.7/default/suricata-xdr-update.tar.gz" | sudo tar -xz -C /usr/local/bin/suricata

To move configuration files into place

• Copy and run the following commands:
  sudo mv /usr/local/bin/suricata/suricata-xdr-update/suricata.yaml /etc/suricata/suricata.yaml
sudo mv /usr/local/bin/suricata/suricata-xdr-update/disable.conf /etc/suricata/disable.conf
sudo mv /usr/local/bin/suricata/suricata-xdr-update/suricata-custom.yaml /etc/suricata/suricata-custom.yaml

To identify your network interface

1. Copy and run the following command to list available network interfaces:
   ip link show

2. Copy the name of the interface you want to monitor (e.g., ens19, eth0, ens192) and store it in a secure place to use in the To configure the Suricata service interface procedure.

To configure the Suricata service interface

1. Copy and run the following command to open the Suricata sysconfig file:
   sudo vi /etc/sysconfig/suricata

2. Find the OPTIONS line and replace the interface with the name of the interface that you copied in the To identify your network interface procedure. For example, if your interface is ens19, the line would read OPTIONS="-i ens19 --user suricata"

3. To save and exit, press Esc, then type :wq and press Enter.

To set the HOME_NET and interface values in suricata.yaml

1. Copy and run the following command to open the suricata.yaml configuration file:
   sudo vi /etc/suricata/suricata.yaml.

2. Type /HOME_NET and press Enter to search.

3. Press i to enter insert mode.

4. Modify the subnet(s) of your internal networks in CIDR format. For example, if the subnet to be monitored is 192.168.0.0/16, the line would read
   HOME_NET: "[192.168.0.0/16]"

5. To configure the network interface, do the following:

   • Press Esc, then type /af-packet and press Enter to search.

   • Press i to enter insert mode.

   • Next to interface, enter your network interface. For example, if your network interface is ens19, the line would read
     af-packet:
- interface: ens19

6. To save and exit, press Esc, then type :wq and press Enter.

To create cron jobs for log cleanup and rule updates

1. Copy and run the following command to open crontab with vi:
   sudo EDITOR=vi crontab -e

2. Press i to enter insert mode, then add the following two lines:
   0 * * * * /usr/bin/find /var/log/suricata/ -name "*.json" -mmin +180 -delete
0 2 * * * /usr/bin/suricata-update && /usr/bin/systemctl restart suricata.service

3. To save and exit, press Esc, then type :wq and press Enter.

To start and verify the service

1. Copy and run the following commands:
   sudo systemctl start suricata.service
sudo systemctl status suricata.service

2. Verify the service is active (running).

To verify Suricata is capturing traffic

• Copy and run the following command:
  ls -la /var/log/suricata/*.json

To view live events

• Copy and run the following command:
  ls -t /var/log/suricata/*.json | head -n 1 | xargs tail -f

Triggering manual alerts for threat simulation

Use this procedure to trigger manual alerts on Ubuntu, Debian, CentOS, Rocky, or Alma 9.x.

To trigger a manual alert for threat simulation

• Run the following command from any system within your network:
  curl http://testmynids.org/uid/index.html

Uninstalling Suricata

To uninstall Suricata, follow the procedure for your environment (below):

• To uninstall Suricata on Ubuntu/Debian

• To uninstall Suricata on CentOS/Rocky/Alma 9.x

To uninstall Suricata on Ubuntu/Debian

1. Run the following commands:
   cd /usr/local/bin/suricata
sudo ./uninstall.sh

To uninstall Suricata on CentOS/Rocky/Alma 9.x

1. Run the following command:
   sudo dnf remove suricata

2. To remove the log cleanup and suricata-update cron jobs, from the terminal open crontab with nano:

   • Type sudo EDITOR=nano crontab -e

   • Remove the following entries:
     0 * * * * /usr/bin/find /var/log/suricata/ -name "*.json" -mmin +180 -delete
0 2 * * * /usr/bin/suricata-update && /usr/bin/systemctl restart suricata.service

3. To save the file, press CTRL + O.

4. To exit, press CTRL + X.