Post cover image

November 2, 2026

how to integrate wazuh with suricata

today we going to learn how to install suricata and integrate it with wazuh:

By Eyad Emad

1 min read

first we do

sudo apt-get install suricata -y
None

next we Download and extract the Emerging Threats Suricata ruleset:

cd /tmp/ && curl -LO https://rules.emergingthreats.net/open/suricata-6.0.8/emerging.rules.tar.gz
sudo tar -xvzf emerging.rules.tar.gz && sudo mkdir /etc/suricata/rules && sudo mv rules/*.rules /etc/suricata/rules/
sudo find /etc/suricata/rules -name "*.rules" -exec chmod 777 {} \;
None

next we dosudo nano /etc/suricata/suricata.yaml

and modify this suricata settings:

HOME_NET: "<UBUNTU_IP>"
EXTERNAL_NET: "any"

default-rule-path: /etc/suricata/rules
rule-files:
- "*.rules"

# Global stats configuration
stats:
enabled: yes

# Linux high speed capture support
af-packet:
  - interface: enp0s3

next we do sudo nano /etc/suricata/suricata.yaml

and modify this settings:

HOME_NET: "<UBUNTU_IP>"
EXTERNAL_NET: "any"

default-rule-path: /etc/suricata/rules
rule-files:
- "*.rules"

# Global stats configuration
stats:
enabled: yes

# Linux high speed capture support
af-packet:
  - interface: enp0s3

and we restart the wazug agent:

sudo systemctl restart suricata

next is sudo nano/var/ossec/etc/ossec.conf

and add this configurations:

<ossec_config>
  <localfile>
    <log_format>json</log_format>
    <location>/var/log/suricata/eve.json</location>
  </localfile>
</ossec_config>
None

next we restart the wazug agent again

sudo systemctl restart wazuh-agent

then we will try to attack the device by ping:

None

and we will head to wazuh dashboard to see what happened

yeah we finally did it:

None

conclusion:

we learned how to install and integrate suricata ids with wazuh