SecurityOnion_Strelka_YaraRule

[ZAEL-H]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

200G

Storage for /nsm

125G

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello
I want to configure strelka to detect malicious traffic (traffic received from Sensor (zeek and suricata )) using yara rule but i don't see any alert from strelka in Dasboard, hunt or Alert
Could you please assist me with how to do it ?
Regards.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Strelka is for file analysis https://docs.securityonion.net/en/2.4/strelka.html. If you are looking to alert on network traffic, Suricata already has signatures for that, for Zeek network traffic you could write a Sigma rule. https://docs.securityonion.net/en/2.4/sigma.html