{"id":30712,"date":"2025-10-01T04:41:39","date_gmt":"2025-10-01T01:41:39","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=30712"},"modified":"2025-10-01T04:41:39","modified_gmt":"2025-10-01T01:41:39","slug":"rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/","title":{"rendered":"Rocky Linux 8 \u00dczerinde Suricata’y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu"},"content":{"rendered":"

<\/p>\n

Rocky Linux 8 \u00dczerinde Suricata’y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu<\/h2>\n

Rocky Linux 8 gibi kurumsal d\u00fczeyde bir i\u015fletim sistemi \u00fczerinde Suricata’y\u0131 bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) olarak yap\u0131land\u0131rmak, a\u011f g\u00fcvenli\u011finizi \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131rman\u0131n g\u00fc\u00e7l\u00fc bir yoludur. Bu kapsaml\u0131 teknik makale, Suricata’n\u0131n kurulumundan, IPS modunda yap\u0131land\u0131r\u0131lmas\u0131na, kural y\u00f6netimine ve sistemin test edilmesine kadar ad\u0131m ad\u0131m bir rehber sunmaktad\u0131r. A\u011f y\u00f6neticileri ve g\u00fcvenlik uzmanlar\u0131 i\u00e7in tasarlanan bu k\u0131lavuz, Suricata’n\u0131n potansiyelini tam olarak kullanarak a\u011f\u0131n\u0131z\u0131 k\u00f6t\u00fc niyetli sald\u0131r\u0131lardan koruman\u0131za yard\u0131mc\u0131 olacakt\u0131r.<\/p>\n

Giri\u015f<\/h3>\n

G\u00fcn\u00fcm\u00fcz\u00fcn s\u00fcrekli geli\u015fen siber tehdit ortam\u0131nda, a\u011f g\u00fcvenli\u011fi her zamankinden daha kritik hale gelmi\u015ftir. Sald\u0131r\u0131 Tespit Sistemleri (IDS) ve Sald\u0131r\u0131 \u00d6nleme Sistemleri (IPS), bu tehditlere kar\u015f\u0131 savunmada temel bile\u015fenlerdir. Suricata, a\u00e7\u0131k kaynakl\u0131, y\u00fcksek performansl\u0131 ve \u00e7oklu i\u015f par\u00e7ac\u0131kl\u0131 bir a\u011f tehdit alg\u0131lama motorudur. Hem IDS hem de IPS modunda \u00e7al\u0131\u015fabilir ve a\u011f trafi\u011fini derinlemesine inceleyerek k\u00f6t\u00fc niyetli aktiviteyi tespit edip engelleyebilir.<\/p>\n

Bir IDS olarak Suricata, \u015f\u00fcpheli etkinlikleri veya bilinen tehdit imzalar\u0131n\u0131 alg\u0131lar ve y\u00f6neticileri uyar\u0131r. Ancak, bir IPS olarak yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131nda, Suricata yaln\u0131zca uyar\u0131 vermekle kalmaz, ayn\u0131 zamanda alg\u0131lanan tehditleri ger\u00e7ek zamanl\u0131 olarak engelleme veya d\u00fc\u015f\u00fcrme yetene\u011fine de sahiptir. Bu, proaktif bir g\u00fcvenlik duru\u015fu sa\u011flayarak sald\u0131r\u0131lar\u0131n a\u011f\u0131n\u0131za zarar vermesini veya hassas verilere eri\u015fmesini \u00f6nler.<\/p>\n

Rocky Linux 8, CentOS’un halefi olarak, kararl\u0131l\u0131\u011f\u0131, g\u00fcvenilirli\u011fi ve kurumsal destek sa\u011flamas\u0131 nedeniyle sunucu ortamlar\u0131 i\u00e7in m\u00fckemmel bir se\u00e7imdir. Suricata’y\u0131 Rocky Linux 8 \u00fczerinde IPS modunda yap\u0131land\u0131rmak, bu sa\u011flam platformun g\u00fcvenlik yeteneklerini art\u0131rman\u0131n mant\u0131kl\u0131 bir yoludur. Bu makalede, Suricata’y\u0131 kurmak, NFQUEUE mekanizmas\u0131 arac\u0131l\u0131\u011f\u0131yla IPS modunu etkinle\u015ftirmek, kural setlerini y\u00f6netmek ve sistemin do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulamak i\u00e7in gerekli t\u00fcm ad\u0131mlar\u0131 ayr\u0131nt\u0131l\u0131 olarak ele alaca\u011f\u0131z. Amac\u0131m\u0131z, a\u011f\u0131n\u0131z\u0131 bilinen ve ortaya \u00e7\u0131kan tehditlere kar\u015f\u0131 koruyan sa\u011flam bir IPS \u00e7\u00f6z\u00fcm\u00fc olu\u015fturman\u0131z i\u00e7in size tam yetki vermektir.<\/p>\n

\u00d6n Gereksinimler<\/h3>\n

Suricata’y\u0131 Rocky Linux 8 \u00fczerinde bir IPS olarak yap\u0131land\u0131rmaya ba\u015flamadan \u00f6nce, a\u015fa\u011f\u0131daki \u00f6n ko\u015fullar\u0131n yerine getirildi\u011finden emin olmal\u0131s\u0131n\u0131z:<\/p>\n

* Rocky Linux 8 Kurulumu:<\/strong> Temiz bir Rocky Linux 8 kurulumuna sahip bir sunucu veya sanal makine.
\n* Root veya Sudo Yetkileri:<\/strong> Komutlar\u0131 \u00e7al\u0131\u015ft\u0131rmak ve sistem yap\u0131land\u0131rmas\u0131n\u0131 de\u011fi\u015ftirmek i\u00e7in root eri\u015fimi veya sudo yetkilerine sahip bir kullan\u0131c\u0131.
\n* Temel Linux Komut Sat\u0131r\u0131 Bilgisi:<\/strong> Temel Linux komutlar\u0131n\u0131 (dosya i\u015flemleri, paket y\u00f6netimi vb.) kullanma becerisi.
\n* A\u011f Aray\u00fcz\u00fc Bilgisi:<\/strong> A\u011f aray\u00fczlerinizin (\u00f6rne\u011fin, eth0<\/code>, enp0s3<\/code>) adlar\u0131n\u0131 ve a\u011f topolojinizi anlama.
\n* \u0130nternet Eri\u015fimi:<\/strong> Gerekli paketleri ve Suricata kurallar\u0131n\u0131 indirmek i\u00e7in internet ba\u011flant\u0131s\u0131.
\n* Yeterli Sistem Kaynaklar\u0131:<\/strong> Suricata, \u00f6zellikle y\u00fcksek a\u011f trafi\u011fi olan ortamlarda \u00f6nemli CPU ve RAM kaynaklar\u0131 t\u00fcketebilir. Yeterli kaynaklara sahip bir sistem \u00f6nerilir.<\/p>\n

Bu \u00f6n ko\u015fullar sa\u011fland\u0131\u011f\u0131nda, Suricata kurulum ve yap\u0131land\u0131rma s\u00fcrecine g\u00fcvenle ba\u015flayabilirsiniz.<\/p>\n

Suricata Kurulumu<\/h3>\n

Suricata’y\u0131 Rocky Linux 8’e kurman\u0131n iki ana yolu vard\u0131r: paket y\u00f6neticisi arac\u0131l\u0131\u011f\u0131yla veya kaynaktan derleyerek. Kaynaktan derleme, en g\u00fcncel s\u00fcr\u00fcm\u00fc edinmenizi ve \u00f6zel yap\u0131land\u0131rma se\u00e7eneklerini (\u00f6zellikle IPS i\u00e7in kritik olan NFQUEUE<\/code> deste\u011fi gibi) etkinle\u015ftirmenizi sa\u011flar. Bu nedenle, kaynaktan derleme y\u00f6ntemi genellikle daha \u00e7ok tercih edilir ve bu k\u0131lavuzda ona odaklanaca\u011f\u0131z.<\/p>\n

Sistem G\u00fcncelleme<\/h4>\n

Kuruluma ba\u015flamadan \u00f6nce sisteminizin g\u00fcncel oldu\u011fundan emin olun ve EPEL deposunu etkinle\u015ftirin. EPEL (Extra Packages for Enterprise Linux), Suricata’n\u0131n baz\u0131 ba\u011f\u0131ml\u0131l\u0131klar\u0131 veya kendisi i\u00e7in yararl\u0131 olabilecek ek paketler sa\u011flar.<\/p>\n

sudo dnf update -y\nsudo dnf install epel-release -y\nsudo dnf upgrade -y<\/code><\/pre>\n
Gerekli Ba\u011f\u0131ml\u0131l\u0131klar\u0131n Kurulumu<\/h4>\n
Suricata’y\u0131 kaynaktan derlemek i\u00e7in bir\u00e7ok geli\u015ftirme arac\u0131na ve k\u00fct\u00fcphaneye ihtiyac\u0131n\u0131z olacakt\u0131r. Bu ba\u011f\u0131ml\u0131l\u0131klar\u0131 a\u015fa\u011f\u0131daki komutla y\u00fckleyebilirsiniz:<\/p>\n
sudo dnf install -y gcc make libpcap-devel pcre-devel libyaml-devel zlib-devel file-devel jansson-devel nss-devel libcap-ng-devel libnet-devel libmaxminddb-devel luajit-devel hwloc-devel openssl-devel rust-toolset<\/code><\/pre>\n
rust-toolset<\/code> genellikle scl enable<\/code> ile etkinle\u015ftirilmesi gereken bir yaz\u0131l\u0131m koleksiyonudur. E\u011fer rustc<\/code> komutunu do\u011frudan bulam\u0131yorsan\u0131z, derleme \u00f6ncesinde scl enable rust-toolset-1.x bash<\/code> (s\u00fcr\u00fcm numaras\u0131 de\u011fi\u015febilir) komutunu \u00e7al\u0131\u015ft\u0131rman\u0131z gerekebilir veya sadece rust<\/code> paketini y\u00fcklemeyi deneyebilirsiniz. Rocky Linux 8’de genellikle dnf install rust<\/code> yeterli olacakt\u0131r.<\/p>\n
Suricata’y\u0131 Kaynaktan Derleme<\/h4>\n
Bu y\u00f6ntem, Suricata’n\u0131n en g\u00fcncel ve optimize edilmi\u015f s\u00fcr\u00fcm\u00fcn\u00fc kurman\u0131z\u0131 sa\u011flar.<\/p>\n
1.  Suricata Kaynak Kodunu \u0130ndirme:<\/strong>
\n    Suricata’n\u0131n resmi web sitesinden (https:\/\/suricata.io\/download\/) en son kararl\u0131 s\u00fcr\u00fcm\u00fcn tarball’\u0131n\u0131 indirin. \u00d6rne\u011fin, 8.0.0<\/code> s\u00fcr\u00fcm\u00fc i\u00e7in:<\/p>\n
cd \/opt\n    sudo wget https:\/\/www.openinfosecfoundation.org\/download\/suricata-8.0.0.tar.gz\n    sudo tar -xvf suricata-8.0.0.tar.gz\n    cd suricata-8.0.0<\/code><\/pre>\n
    Not: 8.0.0<\/code> s\u00fcr\u00fcm numaras\u0131n\u0131 indirdi\u011finiz g\u00fcncel s\u00fcr\u00fcmle de\u011fi\u015ftirin.<\/em><\/p>\n
2.  Yap\u0131land\u0131rma (Configure):<\/strong>
\n    Bu ad\u0131mda, Suricata’y\u0131 IPS modu i\u00e7in kritik olan NFQUEUE<\/code> deste\u011fiyle yap\u0131land\u0131r\u0131yoruz. Ayr\u0131ca kurulum yollar\u0131n\u0131 da belirtiyoruz.<\/p>\n
.\/configure --enable-nfqueue --prefix=\/usr\/local --sysconfdir=\/etc\/suricata --localstatedir=\/var\/log\/suricata<\/code><\/pre>\n
    *   --enable-nfqueue<\/code>: Bu se\u00e7enek, Suricata’n\u0131n Netfilter Queue (NFQUEUE) ile etkile\u015fime girmesini sa\u011flar, bu da IPS modu i\u00e7in hayati \u00f6neme sahiptir.
\n    *   --prefix=\/usr\/local<\/code>: Suricata’n\u0131n ana y\u00fcr\u00fct\u00fclebilir dosyalar\u0131n\u0131n (suricata<\/code>) yerle\u015ftirilece\u011fi dizin.
\n    *   --sysconfdir=\/etc\/suricata<\/code>: Yap\u0131land\u0131rma dosyalar\u0131n\u0131n (suricata.yaml<\/code>, rules<\/code> vb.) yerle\u015ftirilece\u011fi dizin.
\n    *   --localstatedir=\/var\/log\/suricata<\/code>: Log dosyalar\u0131n\u0131n yerle\u015ftirilece\u011fi dizin.<\/p>\n
    configure<\/code> komutunu \u00e7al\u0131\u015ft\u0131rd\u0131ktan sonra, \u00e7\u0131kt\u0131y\u0131 kontrol ederek NFQUEUE<\/code> deste\u011finin etkinle\u015ftirildi\u011finden emin olun. Genellikle “NFQUEUE support: yes” gibi bir sat\u0131r g\u00f6r\u00fcrs\u00fcn\u00fcz.<\/p>\n
3.  Derleme (Make):<\/strong>
\n    Kaynak kodunu derleyin. \u00c7ok \u00e7ekirdekli bir sisteminiz varsa, derleme s\u00fcresini k\u0131saltmak i\u00e7in -j<\/code> bayra\u011f\u0131n\u0131 kullanabilirsiniz (\u00f6rne\u011fin, 4 \u00e7ekirdek i\u00e7in make -j4<\/code>).<\/p>\n
make<\/code><\/pre>\n
4.  Kurulum (Install):<\/strong>
\n    Derlenen dosyalar\u0131 belirtilen sistem dizinlerine kurun.<\/p>\n
sudo make install<\/code><\/pre>\n
5.  Gerekli Dizinleri ve Yap\u0131land\u0131rma Dosyalar\u0131n\u0131 Olu\u015fturma\/Kopyalama:<\/strong>
\n    Suricata’n\u0131n d\u00fczg\u00fcn \u00e7al\u0131\u015fmas\u0131 i\u00e7in baz\u0131 dizinlerin ve varsay\u0131lan yap\u0131land\u0131rma dosyalar\u0131n\u0131n yerinde olmas\u0131 gerekir.<\/p>\n
sudo mkdir -p \/var\/log\/suricata \/etc\/suricata \/etc\/suricata\/rules\n    sudo cp suricata.yaml \/etc\/suricata\/\n    sudo cp classification.config \/etc\/suricata\/\n    sudo cp reference.config \/etc\/suricata\/<\/code><\/pre>\n
6.  Dinamik Ba\u011flay\u0131c\u0131 \u00d6nbelle\u011fini G\u00fcncelleme:<\/strong>
\n    Yeni y\u00fcklenen k\u00fct\u00fcphanelerin sistem taraf\u0131ndan bulunabilmesi i\u00e7in dinamik ba\u011flay\u0131c\u0131 \u00f6nbelle\u011fini g\u00fcncelleyin.<\/p>\n
sudo ldconfig<\/code><\/pre>\n
Suricata art\u0131k sisteminize kurulmu\u015ftur. Bir sonraki ad\u0131m, IPS modunu etkinle\u015ftirmek i\u00e7in NFQUEUE<\/code>‘yu yap\u0131land\u0131rmakt\u0131r.<\/p>\n
NFQUEUE Yap\u0131land\u0131rmas\u0131 (IPS Modu \u0130\u00e7in Anahtar)<\/h3>\n
Suricata’y\u0131 bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) olarak \u00e7al\u0131\u015ft\u0131rman\u0131n temel mekanizmas\u0131, Linux \u00e7ekirde\u011finin Netfilter Queue (NFQUEUE) \u00f6zelli\u011fini kullanmakt\u0131r. NFQUEUE, a\u011f paketlerinin Suricata gibi kullan\u0131c\u0131 alan\u0131 uygulamalar\u0131na g\u00f6nderilmesine ve bu uygulamalar taraf\u0131ndan i\u015flenip ard\u0131ndan geri g\u00f6nderilmesine olanak tan\u0131r.<\/p>\n
NFQUEUE Nedir?<\/h4>\n
Netfilter Queue (NFQUEUE), Linux \u00e7ekirde\u011finin Netfilter \u00e7er\u00e7evesinin bir par\u00e7as\u0131d\u0131r. iptables<\/code> kurallar\u0131 arac\u0131l\u0131\u011f\u0131yla belirli a\u011f paketlerini bir kuyru\u011fa y\u00f6nlendirmemizi sa\u011flar. Suricata, bu kuyruktan paketleri al\u0131r, kendi kural setlerine g\u00f6re inceler ve ard\u0131ndan paketi ya orijinal hedefine geri g\u00f6nderir (IDS modu) ya da d\u00fc\u015f\u00fcr\u00fcr (IPS modu). Bu “b\u0131rakma” yetene\u011fi, Suricata’y\u0131 bir IPS yapan \u015feydir.<\/p>\n
\u00c7ekirdek Mod\u00fcllerini Y\u00fckleme<\/h4>\n
NFQUEUE’nun \u00e7al\u0131\u015fmas\u0131 i\u00e7in ilgili \u00e7ekirdek mod\u00fcllerinin y\u00fckl\u00fc olmas\u0131 gerekir.<\/p>\n
sudo modprobe nf_queue\nsudo modprobe ip_tables\nsudo modprobe ip6_tables # E\u011fer IPv6 trafi\u011fini de inceleyecekseniz<\/code><\/pre>\n
Sistem Ba\u015flang\u0131c\u0131nda Y\u00fckleme<\/h4>\n
Bu mod\u00fcllerin sistem yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda otomatik olarak y\u00fcklenmesini sa\u011flamak i\u00e7in bir yap\u0131land\u0131rma dosyas\u0131 olu\u015fturun:<\/p>\n
echo \"nf_queue\" | sudo tee \/etc\/modules-load.d\/nfqueue.conf\necho \"ip_tables\" | sudo tee -a \/etc\/modules-load.d\/nfqueue.conf\necho \"ip6_tables\" | sudo tee -a \/etc\/modules-load.d\/nfqueue.conf<\/code><\/pre>\n
iptables Kurallar\u0131 Olu\u015fturma<\/h4>\n
\u015eimdi, a\u011f trafi\u011fini Suricata’n\u0131n i\u015fleyece\u011fi NFQUEUE’ya y\u00f6nlendirmek i\u00e7in iptables<\/code> kurallar\u0131 olu\u015fturmam\u0131z gerekiyor. Hangi trafi\u011fi incelemek istedi\u011finize ba\u011fl\u0131 olarak kurallar de\u011fi\u015febilir.<\/p>\n
*   Bir A\u011f Ge\u00e7idi\/Y\u00f6nlendirici Olarak \u00c7al\u0131\u015fan Sistem \u0130\u00e7in:<\/strong> E\u011fer Suricata’y\u0131 bir a\u011f ge\u00e7idi veya y\u00f6nlendirici \u00fczerinde \u00e7al\u0131\u015ft\u0131r\u0131yorsan\u0131z ve farkl\u0131 a\u011flar aras\u0131ndaki trafi\u011fi incelemek istiyorsan\u0131z FORWARD<\/code> zincirini kullan\u0131n.<\/p>\n
sudo iptables -A FORWARD -j NFQUEUE --queue-num 0<\/code><\/pre>\n
*   Bir Ana Bilgisayar Korumas\u0131 \u0130\u00e7in (Yerel Makineyi Korumak):<\/strong> E\u011fer Suricata’y\u0131 do\u011frudan korumak istedi\u011finiz sunucu \u00fczerinde \u00e7al\u0131\u015ft\u0131r\u0131yorsan\u0131z, INPUT<\/code> ve OUTPUT<\/code> zincirlerini kullan\u0131n.<\/p>\n
sudo iptables -A INPUT -j NFQUEUE --queue-num 0\n    sudo iptables -A OUTPUT -j NFQUEUE --queue-num 0<\/code><\/pre>\n
    Not: --queue-num 0<\/code> Suricata’n\u0131n dinleyece\u011fi kuyruk numaras\u0131n\u0131 belirtir. Suricata yap\u0131land\u0131rmas\u0131nda da ayn\u0131 kuyruk numaras\u0131n\u0131 kullanmal\u0131y\u0131z.<\/em><\/p>\n
\u00d6nemli:<\/strong> iptables<\/code> kurallar\u0131 sistem yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda kaybolur. Bu kurallar\u0131n kal\u0131c\u0131 olmas\u0131n\u0131 sa\u011flamak i\u00e7in iptables-services<\/code> paketini kullanabiliriz:<\/p>\n
sudo dnf install iptables-services -y\nsudo systemctl enable iptables\nsudo systemctl start iptables\nsudo iptables-save > \/etc\/sysconfig\/iptables<\/code><\/pre>\n
Bu komutlar, mevcut iptables<\/code> kurallar\u0131n\u0131 \/etc\/sysconfig\/iptables<\/code> dosyas\u0131na kaydeder ve sistem ba\u015flang\u0131c\u0131nda otomatik olarak y\u00fcklenmelerini sa\u011flar.<\/p>\n
Firewalld ile Kullan\u0131m (Alternatif):<\/strong>
\nRocky Linux 8 varsay\u0131lan olarak firewalld<\/code> kullan\u0131r. firewalld<\/code> ile iptables<\/code> kurallar\u0131n\u0131 y\u00f6netmek biraz daha karma\u015f\u0131k olabilir. En basit yakla\u015f\u0131m, firewalld<\/code>‘\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131p iptables-services<\/code>‘\u0131 kullanmakt\u0131r. Ancak firewalld<\/code> kullanmak istiyorsan\u0131z, firewall-cmd --direct<\/code> komutlar\u0131n\u0131 kullanarak NFQUEUE kural\u0131n\u0131 eklemeniz gerekir:<\/p>\n
sudo firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -j NFQUEUE --queue-num 0\nsudo firewall-cmd --reload<\/code><\/pre>\n
Bu makale, daha do\u011frudan kontrol sa\u011flad\u0131\u011f\u0131 i\u00e7in iptables-services<\/code> yakla\u015f\u0131m\u0131n\u0131 takip edecektir. E\u011fer firewalld<\/code> kullanmay\u0131 tercih ediyorsan\u0131z, Suricata’n\u0131n do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak i\u00e7in ek yap\u0131land\u0131rma ve testler yapman\u0131z gerekebilir.<\/p>\n
Suricata Yap\u0131land\u0131rmas\u0131 (suricata.yaml)<\/h3>\n
Suricata’n\u0131n ana yap\u0131land\u0131rma dosyas\u0131 \/etc\/suricata\/suricata.yaml<\/code>‘d\u0131r. Bu dosyada Suricata’n\u0131n nas\u0131l \u00e7al\u0131\u015faca\u011f\u0131n\u0131, hangi kurallar\u0131 kullanaca\u011f\u0131n\u0131 ve IPS modunun nas\u0131l etkinle\u015ftirilece\u011fini belirleriz.<\/p>\n
Yap\u0131land\u0131rma dosyas\u0131n\u0131 d\u00fczenlemek i\u00e7in favori metin d\u00fczenleyicinizi kullan\u0131n:<\/p>\n
sudo vi \/etc\/suricata\/suricata.yaml<\/code><\/pre>\n
Varsay\u0131lan Ayarlar<\/h4>\n
suricata.yaml<\/code> dosyas\u0131nda yap\u0131lmas\u0131 gereken ilk ve en \u00f6nemli ayarlardan biri HOME_NET<\/code> ve EXTERNAL_NET<\/code> de\u011fi\u015fkenlerini tan\u0131mlamakt\u0131r. Suricata, bu de\u011fi\u015fkenleri a\u011f\u0131n\u0131zdaki i\u00e7 ve d\u0131\u015f trafi\u011fi ay\u0131rt etmek i\u00e7in kullan\u0131r ve kurallar genellikle bu tan\u0131mlara g\u00f6re tetiklenir.<\/p>\n
*   HOME_NET<\/code>:<\/strong> Korumak istedi\u011finiz i\u00e7 a\u011f(lar)\u0131 tan\u0131mlay\u0131n. Birden fazla a\u011f\u0131n\u0131z varsa virg\u00fclle ay\u0131rabilirsiniz.<\/p>\n
vars:\n      # vars for your local network\n      # you can specify it as \"any\" or a specific network.\n      # For example, \"192.168.0.0\/16,10.0.0.0\/8\"\n      # This is the network that Suricata will protect.\n      HOME_NET: \"[192.168.1.0\/24]\" # Kendi i\u00e7 a\u011f IP aral\u0131\u011f\u0131n\u0131z\u0131 buraya yaz\u0131n\n      # Example: \"192.168.0.0\/16,10.0.0.0\/8\" for multiple networks<\/code><\/pre>\n
    E\u011fer sadece tek bir IP’yi koruyorsan\u0131z, \"[192.168.1.10]\"<\/code> gibi belirtebilirsiniz.<\/p>\n
*   EXTERNAL_NET<\/code>:<\/strong> HOME_NET<\/code> d\u0131\u015f\u0131ndaki t\u00fcm a\u011flar genellikle EXTERNAL_NET<\/code> olarak kabul edilir. Genellikle !$HOME_NET<\/code> olarak b\u0131rak\u0131l\u0131r.<\/p>\n
EXTERNAL_NET: \"!$HOME_NET\"<\/code><\/pre>\n
*   default-rule-path<\/code>:<\/strong> Suricata kurallar\u0131n\u0131n depoland\u0131\u011f\u0131 dizini belirtir. Kaynaktan kurulum yapt\u0131ysan\u0131z bu genellikle \/etc\/suricata\/rules<\/code> olacakt\u0131r.<\/p>\n
default-rule-path: \/etc\/suricata\/rules<\/code><\/pre>\n
IPS Modunu Etkinle\u015ftirme (nfqueue)<\/h4>\n
IPS modunu etkinle\u015ftirmek i\u00e7in nfqueue<\/code> b\u00f6l\u00fcm\u00fcn\u00fc bulup yap\u0131land\u0131rman\u0131z gerekir. Suricata, af-packet<\/code> veya nfqueue<\/code> gibi farkl\u0131 capture modlar\u0131 kullanabilir. IPS i\u00e7in nfqueue<\/code> kullanmal\u0131y\u0131z.<\/p>\n
suricata.yaml<\/code> dosyas\u0131nda nfqueue:<\/code> b\u00f6l\u00fcm\u00fcn\u00fc bulun ve a\u015fa\u011f\u0131daki gibi d\u00fczenleyin:<\/p>\n
# NFQUEUE support\nnfqueue:\n  - interface: eth0  # \u0130ste\u011fe ba\u011fl\u0131: belirli bir a\u011f aray\u00fcz\u00fc belirtmek i\u00e7in\n    queue-num: 0     # iptables'da kulland\u0131\u011f\u0131n\u0131z kuyruk numaras\u0131yla e\u015fle\u015fmeli\n    queue-bypass: no # Suricata me\u015fgul oldu\u011funda paketleri atlamamas\u0131 i\u00e7in 'no'\n    mode: drop       # IPS i\u00e7in 'drop' olarak ayarlay\u0131n. 'accept' IDS modudur.\n    # copy-mode: copy_packet\n    # copy-range: 2048<\/code><\/pre>\n
*   interface<\/code>:<\/strong> \u0130ste\u011fe ba\u011fl\u0131d\u0131r. E\u011fer belirtilmezse, Suricata t\u00fcm nfqueue<\/code> kuyruklar\u0131n\u0131 dinler. Belirli bir aray\u00fczden gelen trafi\u011fi i\u015flemek istiyorsan\u0131z belirtebilirsiniz.
\n*   queue-num<\/code>:<\/strong> Bu, iptables<\/code> kurallar\u0131nda --queue-num<\/code> ile belirtti\u011finiz kuyruk numaras\u0131yla e\u015fle\u015fmelidir (\u00f6rne\u011fimizde 0<\/code>).
\n*   queue-bypass<\/code>:<\/strong> no<\/code> olarak ayarlanmas\u0131 \u00f6nemlidir. Bu, Suricata’n\u0131n paketleri i\u015fleyemedi\u011finde (\u00f6rne\u011fin, a\u015f\u0131r\u0131 y\u00fcklenme nedeniyle) paketleri atlamamas\u0131n\u0131 sa\u011flar. Bu, g\u00fcvenli bir “fail-safe” davran\u0131\u015f\u0131d\u0131r, ancak performans d\u00fc\u015f\u00fc\u015f\u00fcne neden olabilir. Y\u00fcksek performansl\u0131 ortamlarda dikkatli kullan\u0131lmal\u0131d\u0131r.
\n*   mode: drop<\/code>:<\/strong> Bu, Suricata’y\u0131 IPS moduna ge\u00e7iren en kritik ayard\u0131r. Bir tehdit alg\u0131land\u0131\u011f\u0131nda, Suricata ilgili paketi a\u011fdan d\u00fc\u015f\u00fcrecektir. E\u011fer accept<\/code> olarak ayarlan\u0131rsa, Suricata sadece uyar\u0131 verir (IDS modu).<\/p>\n
Kural Y\u00f6netimi<\/h4>\n
Suricata’n\u0131n tehditleri alg\u0131lay\u0131p engellemesi i\u00e7in kural setlerine ihtiyac\u0131 vard\u0131r.<\/p>\n
*   Kural G\u00fcncelleme Arac\u0131 (suricata-update<\/code>):<\/strong>
\n    Suricata’n\u0131n en \u00f6nemli ara\u00e7lar\u0131ndan biri suricata-update<\/code>‘tir. Bu ara\u00e7, \u00e7e\u015fitli kaynaklardan kural setlerini indirmenize, birle\u015ftirmenize ve Suricata’n\u0131n anlayaca\u011f\u0131 formata d\u00f6n\u00fc\u015ft\u00fcrmenize olanak tan\u0131r.<\/p>\n
sudo suricata-update<\/code><\/pre>\n
    \u0130lk \u00e7al\u0131\u015ft\u0131rmada, suricata-update<\/code> varsay\u0131lan kural kaynaklar\u0131n\u0131 (genellikle ET Open) indirir ve \/etc\/suricata\/rules\/suricata.rules<\/code> adl\u0131 tek bir dosyada birle\u015ftirir. Bu komutu d\u00fczenli olarak \u00e7al\u0131\u015ft\u0131rmak i\u00e7in bir cron<\/code> i\u015fi ayarlaman\u0131z \u00f6nerilir.<\/p>\n
*   Kural Dosyalar\u0131n\u0131 suricata.yaml<\/code>‘a Ekleme:<\/strong>
\n    \u0130ndirilen veya \u00f6zel olarak olu\u015fturdu\u011funuz kural dosyalar\u0131n\u0131 suricata.yaml<\/code> dosyas\u0131n\u0131n rule-files:<\/code> b\u00f6l\u00fcm\u00fcne eklemeniz gerekir.<\/p>\n
rule-files:\n      - suricata.rules        # suricata-update taraf\u0131ndan olu\u015fturulan birle\u015fik kural dosyas\u0131\n      - local.rules           # Kendi \u00f6zel kurallar\u0131n\u0131z\u0131 yazaca\u011f\u0131n\u0131z dosya<\/code><\/pre>\n
    local.rules<\/code> dosyas\u0131n\u0131 sudo touch \/etc\/suricata\/rules\/local.rules<\/code> komutuyla olu\u015fturmay\u0131 unutmay\u0131n. Bu dosya, kendi \u00f6zel alg\u0131lama veya engelleme kurallar\u0131n\u0131z\u0131 eklemek i\u00e7in idealdir.<\/p>\n
Performans Ayarlar\u0131<\/h4>\n
Y\u00fcksek trafikli ortamlarda Suricata’n\u0131n performans\u0131n\u0131 optimize etmek \u00f6nemlidir.<\/p>\n
*   runmode<\/code>:<\/strong> \u00c7ok \u00e7ekirdekli sistemlerde performans\u0131 art\u0131rmak i\u00e7in runmode<\/code>‘u workers<\/code> veya autofp<\/code> olarak ayarlayabilirsiniz.<\/p>\n
runmode:\n      # Set to \"workers\" for multi-threaded operation on multi-core systems.\n      # Set to \"autofp\" for automatic flow processing on multi-core systems.\n      # For IPS mode, \"autofp\" is often preferred.\n      worker-balancer: autofp<\/code><\/pre>\n
*   stream<\/code> ve host<\/code> Ayarlar\u0131:<\/strong> TCP ak\u0131\u015f yeniden birle\u015ftirme ve ana bilgisayar takibi i\u00e7in ayarlar. Varsay\u0131lanlar \u00e7o\u011fu durum i\u00e7in yeterli olsa da, y\u00fcksek y\u00fck alt\u0131nda ince ayar gerekebilir.<\/p>\n
Loglama Ayarlar\u0131<\/h4>\n
Suricata, olaylar\u0131 \u00e7e\u015fitli formatlarda loglayabilir. eve.json<\/code> format\u0131, SIEM (Security Information and Event Management) sistemleriyle entegrasyon i\u00e7in en esnek ve \u00f6nerilen formatt\u0131r.<\/p>\n
outputs:\n  - eve-log:\n      enabled: yes\n      filetype: regular # 'regular' veya 'syslog'\n      filename: eve.json\n      # For IPS, you might want to log 'drop' events explicitly\n      types:\n        - alert\n        - drop # Drop olaylar\u0131n\u0131 da loglamak i\u00e7in\n        - http\n        - dns\n        - tls\n        # ... di\u011fer log t\u00fcrleri<\/code><\/pre>\n
drop<\/code> olaylar\u0131n\u0131 eve.json<\/code> \u00e7\u0131kt\u0131s\u0131nda g\u00f6rmek, IPS’inizin ne zaman ve neden paketleri engelledi\u011fini anlamak i\u00e7in hayati \u00f6neme sahiptir.<\/p>\n
Yap\u0131land\u0131rma dosyas\u0131n\u0131 kaydettikten sonra, Suricata’y\u0131 \u00e7al\u0131\u015ft\u0131rmaya ve test etmeye haz\u0131r\u0131z.<\/p>\n
Suricata’y\u0131 \u00c7al\u0131\u015ft\u0131rma ve Test Etme<\/h3>\n
Suricata’y\u0131 IPS modunda yap\u0131land\u0131rd\u0131ktan sonra, her \u015feyin do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak i\u00e7in test etmemiz gerekir.<\/p>\n
Yap\u0131land\u0131rma Dosyas\u0131n\u0131 Kontrol Etme<\/h4>\n
Suricata’y\u0131 \u00e7al\u0131\u015ft\u0131rmadan \u00f6nce, yap\u0131land\u0131rma dosyan\u0131z\u0131n s\u00f6zdizimsel olarak do\u011fru oldu\u011fundan emin olun.<\/p>\n
sudo suricata -T -c \/etc\/suricata\/suricata.yaml -v<\/code><\/pre>\n
*   -T<\/code>: Yap\u0131land\u0131rma dosyas\u0131n\u0131 test eder ve Suricata’n\u0131n ba\u015flay\u0131p ba\u015flayamayaca\u011f\u0131n\u0131 kontrol eder.
\n*   -c \/etc\/suricata\/suricata.yaml<\/code>: Kullan\u0131lacak yap\u0131land\u0131rma dosyas\u0131n\u0131 belirtir.
\n*   -v<\/code>: Daha detayl\u0131 \u00e7\u0131kt\u0131 sa\u011flar.<\/p>\n
Herhangi bir hata mesaj\u0131 al\u0131rsan\u0131z, suricata.yaml<\/code> dosyas\u0131ndaki ilgili b\u00f6l\u00fcm\u00fc d\u00fczeltmeniz gerekir. “Configuration provided was successfully loaded” gibi bir mesaj g\u00f6rmeniz beklenir.<\/p>\n
Servis Olarak \u00c7al\u0131\u015ft\u0131rma<\/h4>\n
Suricata’y\u0131 bir sistem servisi olarak \u00e7al\u0131\u015ft\u0131rmak, onun arka planda s\u00fcrekli olarak \u00e7al\u0131\u015fmas\u0131n\u0131 ve sistem ba\u015flang\u0131c\u0131nda otomatik olarak ba\u015flamas\u0131n\u0131 sa\u011flar. Kaynaktan kurulum yapt\u0131ysan\u0131z, bir systemd<\/code> birimi olu\u015fturman\u0131z gerekir.<\/p>\n
1.  Systemd Birimi Olu\u015fturma:<\/strong>
\n    A\u015fa\u011f\u0131daki i\u00e7eri\u011fe sahip bir \/etc\/systemd\/system\/suricata.service<\/code> dosyas\u0131 olu\u015fturun:<\/p>\n
[Unit]\n    Description=Suricata IDS\/IPS\n    After=syslog.target network.target\n\n    [Service]\n    Type=simple\n    ExecStart=\/usr\/local\/bin\/suricata -c \/etc\/suricata\/suricata.yaml --nfqueue-instance-range 0:0 --nfqueue-congestion-threshold 50000 --pidfile \/var\/run\/suricata.pid\n    ExecReload=\/bin\/kill -HUP $MAINPID\n    PIDFile=\/var\/run\/suricata.pid\n    Restart=on-failure\n\n    [Install]\n    WantedBy=multi-user.target<\/code><\/pre>\n
    *   ExecStart<\/code>: Suricata’n\u0131n nas\u0131l ba\u015flat\u0131laca\u011f\u0131n\u0131 belirtir. --nfqueue-instance-range 0:0<\/code> Suricata’n\u0131n 0 numaral\u0131 NFQUEUE’yu dinlemesini sa\u011flar. --nfqueue-congestion-threshold<\/code> ise kuyruk doldu\u011funda ne kadar paketin b\u0131rak\u0131laca\u011f\u0131n\u0131 belirler (bu durumda 50000).
\n    *   PIDFile<\/code>: Suricata’n\u0131n PID’sini yazd\u0131\u011f\u0131 dosya.<\/p>\n
2.  Systemd Yap\u0131land\u0131rmas\u0131n\u0131 Yeniden Y\u00fckleme:<\/strong><\/p>\n
sudo systemctl daemon-reload<\/code><\/pre>\n
3.  Suricata Servisini Etkinle\u015ftirme ve Ba\u015flatma:<\/strong><\/p>\n
sudo systemctl enable suricata\n    sudo systemctl start suricata<\/code><\/pre>\n
4.  Servis Durumunu Kontrol Etme:<\/strong><\/p>\n
sudo systemctl status suricata<\/code><\/pre>\n
    Active: active (running)<\/code> ve herhangi bir hata mesaj\u0131 g\u00f6rmedi\u011finizden emin olun.<\/p>\n
IPS Modunu Test Etme<\/h4>\n
Suricata’n\u0131n ger\u00e7ekten IPS modunda \u00e7al\u0131\u015f\u0131p paketleri d\u00fc\u015f\u00fcr\u00fcp d\u00fc\u015f\u00fcrmedi\u011fini test etmek kritik \u00f6neme sahiptir.<\/p>\n
1.  Basit Bir Drop Kural\u0131 Olu\u015fturma:<\/strong>
\n    \/etc\/suricata\/rules\/local.rules<\/code> dosyas\u0131na basit bir test kural\u0131 ekleyin. Bu kural, belirli bir desen i\u00e7eren HTTP isteklerini d\u00fc\u015f\u00fcrecektir.<\/p>\n
sudo vi \/etc\/suricata\/rules\/local.rules<\/code><\/pre>\n
    A\u015fa\u011f\u0131daki kural\u0131 ekleyin:<\/p>\n
drop http any any -> any any (msg:\"TEST: HTTP GET \/drop_me - Suricata IPS Drop Test\"; flow:to_server,established; content:\"GET \/drop_me\"; http_uri; nocase; sid:2000002; rev:1;)<\/code><\/pre>\n
    Bu kural, HTTP GET iste\u011finde \/drop_me<\/code> URI’sini i\u00e7eren herhangi bir trafi\u011fi d\u00fc\u015f\u00fcrecektir.<\/p>\n
2.  Suricata’y\u0131 Yeniden Ba\u015flatma:<\/strong>
\n    Yeni kural\u0131n etkili olmas\u0131 i\u00e7in Suricata servisini yeniden ba\u015flat\u0131n.<\/p>\n
sudo systemctl restart suricata<\/code><\/pre>\n
3.  Drop Kural\u0131n\u0131 Tetikleme:<\/strong>
\n    A\u011f\u0131n\u0131zdaki ba\u015fka bir makineden veya ayn\u0131 makineden (e\u011fer INPUT<\/code>\/OUTPUT<\/code> zincirlerini koruyorsan\u0131z) Suricata’n\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131 sunucuya veya Suricata’n\u0131n korudu\u011fu bir a\u011fdaki bir hedefe a\u015fa\u011f\u0131daki curl<\/code> komutunu g\u00f6nderin:<\/p>\n
curl http:\/\/example.com\/drop_me<\/code><\/pre>\n
    Not: example.com<\/code> yerine, Suricata’n\u0131n izledi\u011fi ve kural\u0131n tetiklenece\u011fi bir web sunucusunun IP adresini veya alan ad\u0131n\u0131 kullan\u0131n.<\/em><\/p>\n
    E\u011fer Suricata IPS modu do\u011fru yap\u0131land\u0131r\u0131lm\u0131\u015fsa, bu curl<\/code> iste\u011fi ba\u015far\u0131s\u0131z olmal\u0131 veya bir zaman a\u015f\u0131m\u0131 hatas\u0131 almal\u0131d\u0131r, \u00e7\u00fcnk\u00fc Suricata paketi d\u00fc\u015f\u00fcrecektir.<\/p>\n
4.  Loglar\u0131 Kontrol Etme:<\/strong>
\n    Suricata loglar\u0131n\u0131 kontrol ederek drop olay\u0131n\u0131n kaydedilip kaydedilmedi\u011fini do\u011frulay\u0131n.<\/p>\n
sudo tail -f \/var\/log\/suricata\/eve.json<\/code><\/pre>\n
    Veya fast.log<\/code> i\u00e7in:<\/p>\n
sudo tail -f \/var\/log\/suricata\/fast.log<\/code><\/pre>\n
    eve.json<\/code> \u00e7\u0131kt\u0131s\u0131nda, event_type: \"drop\"<\/code> ve alert<\/code> mesaj\u0131nda “HTTP GET \/drop_me – Suricata IPS Drop Test” ifadesini aray\u0131n. Bu, Suricata’n\u0131n paketi ba\u015far\u0131yla engelledi\u011fini g\u00f6sterir.<\/p>\n
    \u00d6rnek eve.json<\/code> \u00e7\u0131kt\u0131s\u0131 (ilgili k\u0131s\u0131mlar):<\/strong><\/p>\n
{\n      \"timestamp\": \"2023-10-27T10:30:00.123456+0000\",\n      \"flow_id\": 123456789,\n      \"event_type\": \"alert\",\n      \"src_ip\": \"192.168.1.100\",\n      \"dest_ip\": \"192.168.1.1\",\n      \"proto\": \"TCP\",\n      \"src_port\": 50000,\n      \"dest_port\": 80,\n      \"tx_id\": 0,\n      \"alert\": {\n        \"action\": \"dropped\",  # BURASI \u00d6NEML\u0130! Paketin d\u00fc\u015f\u00fcr\u00fcld\u00fc\u011f\u00fcn\u00fc g\u00f6sterir.\n        \"gid\": 1,\n        \"signature_id\": 2000002,\n        \"rev\": 1,\n        \"signature\": \"TEST: HTTP GET \/drop_me - Suricata IPS Drop Test\",\n        \"category\": \"Potentially Bad Traffic\",\n        \"severity\": 1\n      },\n      \"app_proto\": \"http\",\n      \"http\": {\n        \"hostname\": \"example.com\",\n        \"url\": \"\/drop_me\",\n        \"http_user_agent\": \"curl\/7.61.1\",\n        \"http_method\": \"GET\",\n        \"http_content_type\": \"text\/html\",\n        \"http_response_code\": 0,\n        \"length\": 0\n      }\n    }<\/code><\/pre>\n
    \"action\": \"dropped\"<\/code> sat\u0131r\u0131, Suricata’n\u0131n paketi ba\u015far\u0131yla engelledi\u011fini a\u00e7\u0131k\u00e7a g\u00f6sterir.<\/p>\n
Bu testler, Suricata’n\u0131n IPS modunda do\u011fru bir \u015fekilde \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frular. Art\u0131k a\u011f\u0131n\u0131z, Suricata’n\u0131n kural setleri taraf\u0131ndan alg\u0131lanan ve engellenen tehditlere kar\u015f\u0131 korunmaktad\u0131r.<\/p>\n
Y\u00f6netim ve Bak\u0131m<\/h3>\n
Suricata IPS sisteminin etkinli\u011fini s\u00fcrd\u00fcrmek i\u00e7in d\u00fczenli y\u00f6netim ve bak\u0131m faaliyetleri \u015fartt\u0131r.<\/p>\n
Kural G\u00fcncellemeleri<\/h4>\n
Siber tehdit ortam\u0131 s\u00fcrekli geli\u015fti\u011fi i\u00e7in Suricata kural setlerini g\u00fcncel tutmak hayati \u00f6nem ta\u015f\u0131r.<\/p>\n
*   Otomatik G\u00fcncelleme:<\/strong> suricata-update<\/code> komutunu kullanarak kural g\u00fcncellemelerini otomatikle\u015ftirmek i\u00e7in bir cron<\/code> i\u015fi ayarlay\u0131n. \u00d6rne\u011fin, kurallar\u0131 her g\u00fcn gece 03:00’te g\u00fcncellemek i\u00e7in:<\/p>\n
sudo crontab -e<\/code><\/pre>\n
    A\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin:<\/p>\n
0 3  <\/em> * \/usr\/bin\/suricata-update && systemctl restart suricata<\/code><\/pre>\n
    Bu komut, kurallar\u0131 g\u00fcncelledikten sonra Suricata servisini yeniden ba\u015flatarak yeni kurallar\u0131n y\u00fcklenmesini sa\u011flar. suricata-update<\/code>‘in tam yolunu (which suricata-update<\/code> ile bulabilirsiniz) kulland\u0131\u011f\u0131n\u0131zdan emin olun.<\/p>\n
Log Y\u00f6netimi<\/h4>\n
Suricata, \u00e7ok miktarda log \u00fcretebilir. Bu loglar\u0131 etkin bir \u015fekilde y\u00f6netmek, disk alan\u0131n\u0131n dolmas\u0131n\u0131 \u00f6nler ve g\u00fcvenlik olaylar\u0131n\u0131n analizini kolayla\u015ft\u0131r\u0131r.<\/p>\n
*   Logrotate:<\/strong> logrotate<\/code>‘i kullanarak Suricata log dosyalar\u0131n\u0131 periyodik olarak ar\u015fivleyin, s\u0131k\u0131\u015ft\u0131r\u0131n ve temizleyin. Varsay\u0131lan olarak, Suricata’n\u0131n kurulumu genellikle \/etc\/logrotate.d\/suricata<\/code> alt\u0131nda bir yap\u0131land\u0131rma dosyas\u0131 sa\u011flar. Bu dosyay\u0131 ihtiya\u00e7lar\u0131n\u0131za g\u00f6re ayarlayabilirsiniz.
\n*   SIEM Entegrasyonu:<\/strong> eve.json<\/code> format\u0131ndaki loglar\u0131 bir SIEM (Security Information and Event Management) sistemine (Splunk, ELK Stack, Graylog gibi) g\u00f6ndermek, g\u00fcvenlik olaylar\u0131n\u0131 merkezi olarak toplaman\u0131za, analiz etmenize ve korelasyon kurman\u0131za olanak tan\u0131r. filebeat<\/code> gibi ara\u00e7lar, Suricata loglar\u0131n\u0131 SIEM’e iletmek i\u00e7in kullan\u0131labilir.<\/p>\n
Performans \u0130zleme<\/h4>\n
Suricata’n\u0131n a\u011f \u00fczerindeki performans\u0131 kritik \u00f6neme sahiptir. Y\u00fcksek CPU veya bellek kullan\u0131m\u0131, paket d\u00fc\u015fmelerine veya a\u011f t\u0131kan\u0131kl\u0131\u011f\u0131na yol a\u00e7abilir.<\/p>\n
*   Sistem Kaynaklar\u0131:<\/strong> top<\/code>, htop<\/code>, free -h<\/code> gibi komutlarla CPU, bellek ve disk kullan\u0131m\u0131n\u0131 d\u00fczenli olarak izleyin.
\n*   Suricata \u0130statistikleri:<\/strong> Suricata’n\u0131n kendi istatistiklerini izlemek i\u00e7in suricatasc<\/code> veya suricata -s<\/code> komutlar\u0131n\u0131 kullanabilirsiniz. Bu, d\u00fc\u015f\u00fcr\u00fclen paketler, i\u015flenen paketler ve kural isabetleri hakk\u0131nda de\u011ferli bilgiler sa\u011flar.
\n*   A\u011f \u0130zleme:<\/strong> A\u011f aray\u00fcz\u00fcn\u00fczdeki paket d\u00fc\u015fmelerini ifconfig<\/code> veya ip -s link show<\/code> ile kontrol edin.<\/p>\n
Suricata Ayarlar\u0131n\u0131 Optimize Etme<\/h4>\n
Suricata’n\u0131n performans\u0131n\u0131 ve etkinli\u011fini art\u0131rmak i\u00e7in suricata.yaml<\/code> dosyas\u0131ndaki baz\u0131 ayarlar \u00fczerinde ince ayar yapabilirsiniz:<\/p>\n
*   runmode<\/code> ve worker-balancer<\/code>:<\/strong> Y\u00fcksek trafikli ortamlarda, autofp<\/code> veya workers<\/code> modlar\u0131 ve \u00e7ekirdek say\u0131n\u0131za uygun worker-threads<\/code> ayarlar\u0131 performans\u0131 art\u0131rabilir.
\n*   stream<\/code> ve host<\/code> Ayarlar\u0131:<\/strong> TCP ak\u0131\u015f yeniden birle\u015ftirme ve ana bilgisayar takibi i\u00e7in bellek ve zaman a\u015f\u0131m\u0131 de\u011ferlerini optimize edin.
\n*   Donan\u0131m H\u0131zland\u0131rma:<\/strong> \u00c7ok y\u00fcksek trafikli ortamlar i\u00e7in, PF_RING veya XDP gibi \u00f6zel donan\u0131m veya \u00e7ekirdek tabanl\u0131 h\u0131zland\u0131rma y\u00f6ntemlerini ara\u015ft\u0131rabilirsiniz. Ancak bu ileri d\u00fczey bir yap\u0131land\u0131rmad\u0131r ve ek \u00e7ekirdek mod\u00fclleri veya donan\u0131m gerektirebilir.<\/p>\n
S\u0131k Kar\u015f\u0131la\u015f\u0131lan Sorunlar ve \u00c7\u00f6z\u00fcmleri<\/h3>\n
Suricata IPS’yi yap\u0131land\u0131r\u0131rken veya \u00e7al\u0131\u015ft\u0131r\u0131rken baz\u0131 yayg\u0131n sorunlarla kar\u015f\u0131la\u015fabilirsiniz. \u0130\u015fte bunlardan baz\u0131lar\u0131 ve olas\u0131 \u00e7\u00f6z\u00fcmleri:<\/p>\n
Paket D\u00fc\u015fme Sorunlar\u0131 (IPS Modunda Beklendi\u011fi Gibi \u00c7al\u0131\u015fmama)<\/h4>\n
*   Sorun:<\/strong> Kurallar tetikleniyor ancak paketler d\u00fc\u015f\u00fcr\u00fclm\u00fcyor veya trafik hala ge\u00e7iyor.
\n*   \u00c7\u00f6z\u00fcm:<\/strong>
\n    *   suricata.yaml<\/code> dosyas\u0131nda nfqueue<\/code> b\u00f6l\u00fcm\u00fcndeki mode: drop<\/code> ayar\u0131n\u0131 kontrol edin. accept<\/code> de\u011fil, drop<\/code> olmal\u0131d\u0131r.
\n    *   iptables<\/code> kurallar\u0131n\u0131z\u0131n do\u011fru oldu\u011fundan ve trafi\u011fi Suricata’n\u0131n dinledi\u011fi NFQUEUE’ya y\u00f6nlendirdi\u011finden emin olun (--queue-num<\/code> de\u011ferleri e\u015fle\u015fmeli).
\n    *   Suricata servisini yeniden ba\u015flatt\u0131ktan sonra iptables -L -v -n<\/code> komutuyla kurallar\u0131n aktif oldu\u011funu do\u011frulay\u0131n.
\n    *   sudo systemctl status suricata<\/code> komutuyla Suricata servisinin hatas\u0131z \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 kontrol edin.
\n    *   Loglar\u0131 (\/var\/log\/suricata\/eve.json<\/code>) kontrol ederek action: \"dropped\"<\/code> girdilerinin g\u00f6r\u00fcn\u00fcp g\u00f6r\u00fcnmedi\u011fine bak\u0131n. E\u011fer sadece action: \"alert\"<\/code> g\u00f6r\u00fcyorsan\u0131z, Suricata paketi d\u00fc\u015f\u00fcrm\u00fcyor demektir.<\/p>\n
Performans Sorunlar\u0131 (Y\u00fcksek CPU\/Bellek Kullan\u0131m\u0131, A\u011f Gecikmesi)<\/h4>\n
*   Sorun:<\/strong> Suricata \u00e7al\u0131\u015ft\u0131\u011f\u0131nda sistem yava\u015fl\u0131yor, a\u011f gecikmesi ya\u015fan\u0131yor veya paketler d\u00fc\u015f\u00fcyor (Suricata taraf\u0131ndan de\u011fil, a\u011f aray\u00fcz\u00fc taraf\u0131ndan).
\n*   \u00c7\u00f6z\u00fcm:<\/strong>
\n    *   Kural Say\u0131s\u0131:<\/strong> \u00c7ok fazla aktif kural, CPU y\u00fck\u00fcn\u00fc art\u0131r\u0131r. Gereksiz veya eski kurallar\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131n veya daha k\u00fc\u00e7\u00fck, hedefe y\u00f6nelik kural setleri kullan\u0131n.
\n    *   runmode<\/code> ve worker-balancer<\/code>:<\/strong> \u00c7ok \u00e7ekirdekli sistemlerde suricata.yaml<\/code> dosyas\u0131ndaki runmode<\/code>‘u autofp<\/code> veya workers<\/code> olarak ayarlay\u0131n ve worker-threads<\/code> say\u0131s\u0131n\u0131 CPU \u00e7ekirdeklerinize g\u00f6re optimize edin.
\n    *   Donan\u0131m Kaynaklar\u0131:<\/strong> Suricata i\u00e7in yeterli CPU, RAM ve h\u0131zl\u0131 disk (loglama i\u00e7in) ay\u0131rd\u0131\u011f\u0131n\u0131zdan emin olun. \u00d6zellikle y\u00fcksek trafikli ortamlarda daha g\u00fc\u00e7l\u00fc donan\u0131m gerekebilir.
\n    *   nfqueue-congestion-threshold<\/code>:<\/strong> Bu de\u011feri Suricata’n\u0131n systemd<\/code> birimindeki ExecStart<\/code> sat\u0131r\u0131nda ayarlayarak, NFQUEUE’nun paketleri do\u011frudan d\u00fc\u015f\u00fcrmeden \u00f6nce ne kadar bekleyece\u011fini ayarlayabilirsiniz. A\u015f\u0131r\u0131 y\u00fcksek de\u011ferler bellek t\u00fcketimini art\u0131rabilir, \u00e7ok d\u00fc\u015f\u00fck de\u011ferler ise me\u015fgul Suricata’n\u0131n paketleri erken d\u00fc\u015f\u00fcrmesine neden olabilir.<\/p>\n
Kural G\u00fcncelleme Sorunlar\u0131<\/h4>\n
*   Sorun:<\/strong> suricata-update<\/code> kurallar\u0131 indiremiyor veya g\u00fcncelleyemiyor.
\n*   \u00c7\u00f6z\u00fcm:<\/strong>
\n    *   \u0130nternet Eri\u015fimi:<\/strong> Suricata sunucusunun internet eri\u015fimi oldu\u011fundan emin olun.
\n    *   DNS \u00c7\u00f6z\u00fcmlemesi:<\/strong> DNS \u00e7\u00f6z\u00fcmlemesinin do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 kontrol edin.
\n    *   Proxy Ayarlar\u0131:<\/strong> E\u011fer bir proxy sunucusu kullan\u0131yorsan\u0131z, suricata-update<\/code> i\u00e7in proxy ayarlar\u0131n\u0131 do\u011fru yap\u0131land\u0131rd\u0131\u011f\u0131n\u0131zdan emin olun (genellikle http_proxy<\/code> ve https_proxy<\/code> ortam de\u011fi\u015fkenleri).
\n    *   Kural Kaynaklar\u0131:<\/strong> suricata-update<\/code> yap\u0131land\u0131rmas\u0131nda (\/etc\/suricata\/update.yaml<\/code>) belirtilen kural kaynaklar\u0131n\u0131n (\u00f6rne\u011fin ET Open) eri\u015filebilir ve do\u011fru oldu\u011fundan emin olun.<\/p>\n
Yanl\u0131\u015f Pozitifler (False Positives)<\/h4>\n
*   Sorun:<\/strong> Suricata, normal ve zarars\u0131z trafi\u011fi k\u00f6t\u00fc niyetli olarak alg\u0131l\u0131yor ve engelliyor.
\n*   \u00c7\u00f6z\u00fcm:<\/strong>
\n    *   Kural Daraltma:<\/strong> Yanl\u0131\u015f pozitiflere neden olan belirli kural\u0131 tespit edin. Bu kural\u0131 daha spesifik hale getirmek i\u00e7in HOME_NET<\/code>, EXTERNAL_NET<\/code>, portlar veya protokoller gibi parametreleri daralt\u0131n.
\n    *   Kural\u0131 Devre D\u0131\u015f\u0131 B\u0131rakma:<\/strong> E\u011fer bir kural s\u00fcrekli olarak yanl\u0131\u015f pozitiflere neden oluyorsa ve a\u011f\u0131n\u0131z i\u00e7in kritik de\u011filse, suricata.yaml<\/code> dosyas\u0131ndaki rule-files<\/code> listesinden kald\u0131rarak veya local.rules<\/code> dosyas\u0131nda noalert<\/code> veya drop<\/code> yerine pass<\/code> kullanarak devre d\u0131\u015f\u0131 b\u0131rakabilirsiniz.
\n    *   Beyaz Liste (Whitelist) Olu\u015fturma:<\/strong> Belirli IP adreslerinden veya a\u011flardan gelen trafi\u011fi incelemenin d\u0131\u015f\u0131nda tutmak i\u00e7in pass<\/code> kurallar\u0131 kullan\u0131n. pass<\/code> kurallar\u0131, alert<\/code> veya drop<\/code> kurallar\u0131ndan \u00f6nce i\u015flenir.
\n    *   \u00d6rnek local.rules<\/code> whitelist kural\u0131:<\/strong><\/p>\n
pass ip [192.168.1.10] any -> any any (msg:\"WHITELIST: Allow traffic from trusted host\"; sid:2000004; rev:1;)<\/code><\/pre>\n
        Bu kural, 192.168.1.10<\/code> IP adresinden gelen t\u00fcm trafi\u011fi Suricata’n\u0131n di\u011fer kurallar\u0131n\u0131 atlayarak ge\u00e7irmesini sa\u011flar.<\/p>\n
Bu sorun giderme ipu\u00e7lar\u0131, Suricata IPS sisteminizin sorunsuz ve etkili bir \u015fekilde \u00e7al\u0131\u015fmas\u0131na yard\u0131mc\u0131 olacakt\u0131r. Herhangi bir de\u011fi\u015fiklik yapt\u0131ktan sonra Suricata servisini yeniden ba\u015flatmay\u0131 ve loglar\u0131 kontrol etmeyi unutmay\u0131n.<\/p>\n
Sonu\u00e7<\/h3>\n
Bu kapsaml\u0131 teknik makalede, Rocky Linux 8 \u00fczerinde Suricata’y\u0131 g\u00fc\u00e7l\u00fc bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) olarak nas\u0131l yap\u0131land\u0131raca\u011f\u0131m\u0131z\u0131 ad\u0131m ad\u0131m inceledik. Suricata’n\u0131n kurulumundan, IPS modunu etkinle\u015ftirmek i\u00e7in Netfilter Queue (NFQUEUE) entegrasyonuna, suricata.yaml<\/code> dosyas\u0131n\u0131n kritik ayarlar\u0131ndan, kural y\u00f6netimine ve sistemin i\u015flevselli\u011fini do\u011frulamak i\u00e7in yap\u0131lan testlere kadar t\u00fcm s\u00fcreci detayland\u0131rd\u0131k.<\/p>\n
Suricata’y\u0131 bir IPS olarak kullanmak, a\u011f g\u00fcvenli\u011finizi pasif izlemeden aktif tehdit engellemeye ta\u015f\u0131yarak, a\u011f\u0131n\u0131za y\u00f6nelik k\u00f6t\u00fc niyetli sald\u0131r\u0131lara kar\u015f\u0131 proaktif bir savunma katman\u0131 sa\u011flar. Rocky Linux 8’in kararl\u0131l\u0131\u011f\u0131 ve Suricata’n\u0131n esnekli\u011fi bir araya geldi\u011finde, k\u00fc\u00e7\u00fck ofislerden b\u00fcy\u00fck kurumsal a\u011flara kadar geni\u015f bir yelpazedeki ortamlar i\u00e7in sa\u011flam ve g\u00fcvenilir bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fc sunar.<\/p>\n
Unutmay\u0131n ki a\u011f g\u00fcvenli\u011fi s\u00fcrekli bir s\u00fcre\u00e7tir. Kurallar\u0131 d\u00fczenli olarak g\u00fcncellemek, sistem loglar\u0131n\u0131 izlemek, performans metriklerini takip etmek ve ortaya \u00e7\u0131kan tehditlere kar\u015f\u0131 yap\u0131land\u0131rman\u0131z\u0131 optimize etmek, Suricata IPS’inizin etkinli\u011fini uzun vadede s\u00fcrd\u00fcrmek i\u00e7in hayati \u00f6neme sahiptir. Yanl\u0131\u015f pozitifleri ele almak ve a\u011f\u0131n\u0131z\u0131n benzersiz ihtiya\u00e7lar\u0131na g\u00f6re Suricata’y\u0131 ince ayarlamak, sisteminizin hem g\u00fcvenli hem de i\u015flevsel kalmas\u0131n\u0131 sa\u011flayacakt\u0131r.<\/p>\n
Bu k\u0131lavuz, Suricata IPS’inizi Rocky Linux 8 \u00fczerinde ba\u015far\u0131yla kurman\u0131z ve y\u00f6netmeniz i\u00e7in size gerekli bilgi ve ara\u00e7lar\u0131 sa\u011flam\u0131\u015ft\u0131r. Bu g\u00fc\u00e7l\u00fc ara\u00e7la, a\u011f\u0131n\u0131z\u0131 siber tehditlerin s\u00fcrekli de\u011fi\u015fen ortam\u0131na kar\u015f\u0131 daha g\u00fcvenli hale getirme yolunda \u00f6nemli bir ad\u0131m atm\u0131\u015f olursunuz. \u0130leri ad\u0131mlar olarak, daha karma\u015f\u0131k kural setleri olu\u015fturmay\u0131, SIEM sistemleriyle entegrasyonu derinle\u015ftirmeyi ve y\u00fcksek eri\u015filebilirlik (HA) \u00e7\u00f6z\u00fcmlerini ara\u015ft\u0131rmay\u0131 d\u00fc\u015f\u00fcnebilirsiniz.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Rocky Linux 8 \u00dczerinde Suricata’y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu\nRocky Linux 8 gibi kurumsal d\u00fczeyde bir i\u015f","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[241],"tags":[],"class_list":{"0":"post-30712","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-linux","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nRocky Linux 8 \u00dczerinde Suricata'y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Rocky Linux 8 \u00dczerinde Suricata'y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu\" \/>\n<meta property=\"og:description\" content=\"Rocky Linux 8 \u00dczerinde Suricata'y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu Rocky Linux 8 gibi kurumsal d\u00fczeyde bir i\u015f\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-01T01:41:39+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"24 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Rocky Linux 8 \u00dczerinde Suricata’y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu\",\"datePublished\":\"2025-10-01T01:41:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/\"},\"wordCount\":3969,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Linux\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/\",\"name\":\"Rocky Linux 8 \u00dczerinde Suricata'y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-10-01T01:41:39+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Rocky Linux 8 \u00dczerinde Suricata’y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Rocky Linux 8 \u00dczerinde Suricata'y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/","og_locale":"tr_TR","og_type":"article","og_title":"Rocky Linux 8 \u00dczerinde Suricata'y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu","og_description":"Rocky Linux 8 \u00dczerinde Suricata'y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu Rocky Linux 8 gibi kurumsal d\u00fczeyde bir i\u015f","og_url":"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-10-01T01:41:39+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"24 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Rocky Linux 8 \u00dczerinde Suricata’y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu","datePublished":"2025-10-01T01:41:39+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/"},"wordCount":3969,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Linux"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/","url":"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/","name":"Rocky Linux 8 \u00dczerinde Suricata'y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-10-01T01:41:39+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/rocky-linux-8-uzerinde-suricatayi-bir-saldiri-onleme-sistemi-ips-olarak-yapilandirma-kilavuzu\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Rocky Linux 8 \u00dczerinde Suricata’y\u0131 Bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) Olarak Yap\u0131land\u0131rma K\u0131lavuzu"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/30712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=30712"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/30712\/revisions"}],"predecessor-version":[{"id":30713,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/30712\/revisions\/30713"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=30712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=30712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=30712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}