{"id":34122,"date":"2025-11-11T12:41:05","date_gmt":"2025-11-11T09:41:05","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=34122"},"modified":"2025-11-11T12:41:05","modified_gmt":"2025-11-11T09:41:05","slug":"suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/","title":{"rendered":"Suricata’y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m"},"content":{"rendered":"

<\/p>\n

Suricata’y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m<\/h2>\n

Giri\u015f: A\u011f G\u00fcvenli\u011finde Suricata’n\u0131n Rol\u00fc<\/h3>\n

G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla geli\u015fen siber g\u00fcvenlik ortam\u0131nda, a\u011flar\u0131 k\u00f6t\u00fc niyetli sald\u0131r\u0131lardan korumak her zamankinden daha kritik hale gelmi\u015ftir. \u0130\u015fletmeler ve bireyler, s\u00fcrekli evrilen tehditlere kar\u015f\u0131 koymak i\u00e7in proaktif savunma mekanizmalar\u0131na ihtiya\u00e7 duymaktad\u0131r. Bu noktada, A\u011f Sald\u0131r\u0131 Tespit Sistemi (IDS) ve A\u011f Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) gibi ara\u00e7lar devreye girer. Suricata, bu alanda \u00f6ne \u00e7\u0131kan, a\u00e7\u0131k kaynakl\u0131 ve y\u00fcksek performansl\u0131 bir tehdit alg\u0131lama motorudur. Ubuntu 20.04, kararl\u0131l\u0131\u011f\u0131 ve geni\u015f topluluk deste\u011fi sayesinde, Suricata gibi g\u00fc\u00e7l\u00fc ara\u00e7lar\u0131 \u00e7al\u0131\u015ft\u0131rmak i\u00e7in ideal bir platform sunar. Bu makalede, Suricata’y\u0131 Ubuntu 20.04 \u00fczerine nas\u0131l kuraca\u011f\u0131n\u0131z\u0131, yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131 ve y\u00f6netece\u011finizi ad\u0131m ad\u0131m, kapsaml\u0131 bir \u015fekilde inceleyece\u011fiz.<\/p>\n

Suricata Nedir?<\/h4>\n

Suricata, OISF (Open Information Security Foundation) taraf\u0131ndan geli\u015ftirilen, a\u00e7\u0131k kaynakl\u0131, \u00e7ok i\u015f par\u00e7ac\u0131kl\u0131 bir a\u011f tehdit alg\u0131lama motorudur. Hem bir IDS (Intrusion Detection System) hem de bir IPS (Intrusion Prevention System) olarak i\u015flev g\u00f6rebilir. Geli\u015fmi\u015f kural tabanl\u0131 alg\u0131lama yetenekleri sayesinde, bilinen sald\u0131r\u0131lar\u0131, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131, a\u011f anormalliklerini ve di\u011fer \u015f\u00fcpheli etkinlikleri tespit edebilir. Suricata, Snort’un modern bir alternatifi olarak kabul edilir ve daha iyi performans, daha esnek yap\u0131land\u0131rma se\u00e7enekleri ve geli\u015fmi\u015f protokol analizi gibi \u00f6zellikler sunar.<\/p>\n

Neden Suricata Kullanmal\u0131y\u0131z?<\/h4>\n

Suricata’n\u0131n tercih edilmesinin bir\u00e7ok nedeni vard\u0131r:
\n* Y\u00fcksek Performans:<\/strong> \u00c7ok i\u015f par\u00e7ac\u0131kl\u0131 yap\u0131s\u0131 sayesinde, \u00e7ok \u00e7ekirdekli i\u015flemcilerden tam verim alarak y\u00fcksek trafikli a\u011flarda bile etkili bir \u015fekilde \u00e7al\u0131\u015fabilir.
\n* Esneklik:<\/strong> IDS, IPS ve NSM (Network Security Monitoring) modlar\u0131nda \u00e7al\u0131\u015fabilir. Bu, onu farkl\u0131 g\u00fcvenlik ihtiya\u00e7lar\u0131 i\u00e7in \u00e7ok y\u00f6nl\u00fc bir ara\u00e7 haline getirir.
\n* Geli\u015fmi\u015f Protokol Analizi:<\/strong> HTTP, TLS, DNS gibi pop\u00fcler protokolleri derinlemesine analiz edebilir ve bu protokoller \u00fczerindeki anormallikleri veya sald\u0131r\u0131lar\u0131 tespit edebilir.
\n* Geni\u015f Kural Deste\u011fi:<\/strong> Snort kurallar\u0131 ile uyumludur ve Emerging Threats (ET Open) gibi pop\u00fcler kural setlerini destekler. Ayr\u0131ca, kendi \u00f6zel kurallar\u0131n\u0131z\u0131 yazman\u0131za da olanak tan\u0131r.
\n* \u00c7e\u015fitli \u00c7\u0131kt\u0131 Formatlar\u0131:<\/strong> G\u00fcnl\u00fckleri \u00e7e\u015fitli formatlarda (JSON, YAML, eve.json, fast.log vb.) \u00fcretebilir, bu da onu SIEM (Security Information and Event Management) sistemleri ile entegrasyon i\u00e7in ideal k\u0131lar.
\n* A\u00e7\u0131k Kaynak:<\/strong> A\u00e7\u0131k kaynakl\u0131 olmas\u0131, s\u00fcrekli geli\u015fimini ve geni\u015f bir topluluk deste\u011fini garanti eder.<\/p>\n

Ubuntu 20.04 ve Suricata Uyumu<\/h4>\n

Ubuntu 20.04 (Focal Fossa), uzun s\u00fcreli destek (LTS) s\u00fcr\u00fcm\u00fc olmas\u0131 nedeniyle, sunucu ortamlar\u0131nda ve g\u00fcvenlik uygulamalar\u0131nda s\u0131kl\u0131kla tercih edilen bir i\u015fletim sistemidir. Kararl\u0131l\u0131\u011f\u0131, g\u00fcncel paketleri ve geni\u015f yaz\u0131l\u0131m deposu, Suricata gibi kritik g\u00fcvenlik ara\u00e7lar\u0131n\u0131n sorunsuz bir \u015fekilde kurulup \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131 i\u00e7in sa\u011flam bir temel sunar. Bu kombinasyon, a\u011f g\u00fcvenli\u011fi altyap\u0131n\u0131z\u0131 g\u00fc\u00e7lendirmek i\u00e7in g\u00fc\u00e7l\u00fc ve g\u00fcvenilir bir \u00e7\u00f6z\u00fcm sa\u011flar.<\/p>\n

Suricata Kurulum \u00d6ncesi Haz\u0131rl\u0131klar<\/h3>\n

Suricata kurulumuna ba\u015flamadan \u00f6nce, sisteminizin belirli gereksinimleri kar\u015f\u0131lad\u0131\u011f\u0131ndan ve gerekli \u00f6n haz\u0131rl\u0131klar\u0131n yap\u0131ld\u0131\u011f\u0131ndan emin olman\u0131z \u00f6nemlidir. Bu ad\u0131mlar, kurulum s\u00fcrecinin sorunsuz ilerlemesini ve Suricata’n\u0131n en iyi performans\u0131 g\u00f6stermesini sa\u011flayacakt\u0131r.<\/p>\n

Sistem Gereksinimleri<\/h4>\n

Suricata, a\u011f trafi\u011fini derinlemesine analiz etti\u011fi i\u00e7in belirli sistem kaynaklar\u0131na ihtiya\u00e7 duyar. Gereksinimler, izlenecek a\u011f trafi\u011finin hacmine ve kullan\u0131lacak kural setlerinin karma\u015f\u0131kl\u0131\u011f\u0131na g\u00f6re de\u011fi\u015fir:
\n* \u0130\u015flemci (CPU):<\/strong> Y\u00fcksek trafikli a\u011flar i\u00e7in \u00e7ok \u00e7ekirdekli bir i\u015flemci (Intel i5\/i7 veya Xeon serisi, AMD Ryzen\/EPYC) \u015fiddetle tavsiye edilir. Suricata’n\u0131n \u00e7ok i\u015f par\u00e7ac\u0131kl\u0131 yap\u0131s\u0131ndan tam olarak yararlanmak i\u00e7in en az 4 \u00e7ekirdek idealdir.
\n* Bellek (RAM):<\/strong> Kural setlerinin boyutu ve tutulan oturum bilgileri nedeniyle yeterli RAM kritik \u00f6neme sahiptir. K\u00fc\u00e7\u00fck a\u011flar i\u00e7in 4-8 GB yeterli olabilirken, orta ve b\u00fcy\u00fck \u00f6l\u00e7ekli a\u011flar i\u00e7in 16 GB veya daha fazlas\u0131 \u00f6nerilir.
\n* Depolama (Disk):<\/strong> G\u00fcnl\u00fck dosyalar\u0131 h\u0131zla b\u00fcy\u00fcyebilir. Bu nedenle, h\u0131zl\u0131 bir depolama birimi (SSD) ve yeterli bo\u015f alan (en az 50-100 GB, trafik yo\u011funlu\u011funa ba\u011fl\u0131 olarak daha fazla) gereklidir.
\n* A\u011f Aray\u00fcz\u00fc Kart\u0131 (NIC):<\/strong> A\u011f trafi\u011fini yakalamak i\u00e7in \u00f6zel bir a\u011f aray\u00fcz\u00fc kart\u0131 veya Suricata’n\u0131n dinleyece\u011fi birden fazla aray\u00fcz gerekebilir. Y\u00fcksek h\u0131zl\u0131 (Gigabit Ethernet veya 10 Gigabit Ethernet) kartlar, performans a\u00e7\u0131s\u0131ndan \u00f6nemlidir.<\/p>\n

Sistem G\u00fcncelleme ve Ba\u011f\u0131ml\u0131l\u0131klar\u0131n Kurulumu<\/h4>\n

Herhangi bir yaz\u0131l\u0131m kurulumuna ba\u015flamadan \u00f6nce sisteminizi g\u00fcncel tutmak iyi bir uygulamad\u0131r. Bu, potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 kapat\u0131r ve en yeni paket s\u00fcr\u00fcmlerine sahip olman\u0131z\u0131 sa\u011flar.
\nTerminali a\u00e7\u0131n ve a\u015fa\u011f\u0131daki komutlar\u0131 \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n

sudo apt update\nsudo apt upgrade -y<\/code><\/pre>\n
Suricata’n\u0131n d\u00fczg\u00fcn \u00e7al\u0131\u015fmas\u0131 i\u00e7in baz\u0131 ba\u011f\u0131ml\u0131l\u0131k paketlerine ihtiyac\u0131 vard\u0131r. Bu paketler, Suricata’n\u0131n derlenmesi veya \u00e7al\u0131\u015fmas\u0131 i\u00e7in gerekli k\u00fct\u00fcphaneleri ve ara\u00e7lar\u0131 sa\u011flar.<\/p>\n
sudo apt install -y build-essential libpcap-dev libnet1-dev libyaml-dev zlib1g-dev libcap-ng-dev libmagic-dev libjansson-dev libnss3-dev liblz4-dev libmaxminddb-dev libtool automake autoconf pkg-config git python3-pip<\/code><\/pre>\n
*   build-essential<\/code>: Derleme i\u00e7in temel ara\u00e7lar.
\n*   libpcap-dev<\/code>: A\u011f trafi\u011fini yakalamak i\u00e7in pcap k\u00fct\u00fcphanesi.
\n*   libnet1-dev<\/code>: A\u011f paketleri olu\u015fturmak i\u00e7in libnet k\u00fct\u00fcphanesi.
\n*   libyaml-dev<\/code>: YAML yap\u0131land\u0131rma dosyalar\u0131n\u0131 ayr\u0131\u015ft\u0131rmak i\u00e7in.
\n*   zlib1g-dev<\/code>: S\u0131k\u0131\u015ft\u0131rma k\u00fct\u00fcphanesi.
\n*   libcap-ng-dev<\/code>: Yetenek y\u00f6netimi.
\n*   libmagic-dev<\/code>: Dosya t\u00fcr\u00fc tespiti.
\n*   libjansson-dev<\/code>: JSON verilerini i\u015flemek i\u00e7in.
\n*   libnss3-dev<\/code>: NSS (Network Security Services) k\u00fct\u00fcphanesi.
\n*   liblz4-dev<\/code>: LZ4 s\u0131k\u0131\u015ft\u0131rma k\u00fct\u00fcphanesi.
\n*   libmaxminddb-dev<\/code>: GeoIP veritaban\u0131 deste\u011fi.
\n*   libtool<\/code>, automake<\/code>, autoconf<\/code>, pkg-config<\/code>: Derleme ara\u00e7lar\u0131.
\n*   git<\/code>: Suricata kaynak kodunu indirmek i\u00e7in.
\n*   python3-pip<\/code>: Suricata-update gibi ara\u00e7lar i\u00e7in Python paket y\u00f6neticisi.<\/p>\n
A\u011f Aray\u00fcz\u00fcn\u00fc Promiscuous Moda Alma<\/h4>\n
Suricata’n\u0131n a\u011fdaki t\u00fcm trafi\u011fi g\u00f6rebilmesi i\u00e7in dinleyece\u011fi a\u011f aray\u00fcz\u00fcn\u00fcn promiscuous (kar\u0131\u015f\u0131k) modda olmas\u0131 gerekir. Bu mod, a\u011f aray\u00fcz\u00fcn\u00fcn kendisine y\u00f6nlendirilmeyen paketleri bile yakalamas\u0131na olanak tan\u0131r. \u00c7o\u011fu modern Linux da\u011f\u0131t\u0131m\u0131nda Suricata gibi ara\u00e7lar bu modu otomatik olarak ayarlar, ancak manuel olarak kontrol etmek veya ayarlamak gerekebilir.
\nA\u011f aray\u00fcz\u00fcn\u00fcz\u00fcn ad\u0131n\u0131 ip a<\/code> veya ifconfig<\/code> komutlar\u0131yla bulabilirsiniz (\u00f6rne\u011fin eth0<\/code> veya enp0s3<\/code>).<\/p>\n
sudo ip link set dev  promisc on<\/code><\/pre>\n
\u00d6rnek:<\/p>\n
sudo ip link set dev enp0s3 promisc on<\/code><\/pre>\n
Bu ayar yeniden ba\u015flatmada kaybolur. Kal\u0131c\u0131 hale getirmek i\u00e7in \/etc\/network\/interfaces<\/code> veya netplan<\/code> yap\u0131land\u0131rmas\u0131n\u0131 d\u00fczenlemeniz gerekebilir. Ancak Suricata genellikle kendi servisi ba\u015flad\u0131\u011f\u0131nda bu ayar\u0131 yapar.<\/p>\n
Suricata Kurulum Y\u00f6ntemleri<\/h3>\n
Suricata’y\u0131 Ubuntu 20.04 \u00fczerine kurmak i\u00e7in iki ana y\u00f6ntem vard\u0131r: APT paket y\u00f6neticisi ile kurulum (daha kolay ve \u00f6nerilen) ve kaynak koddan kurulum (daha fazla kontrol ve en g\u00fcncel s\u00fcr\u00fcm i\u00e7in).<\/p>\n
APT Paket Y\u00f6neticisi ile Kurulum (\u00d6nerilen ve Daha Basit Y\u00f6ntem)<\/h4>\n
Bu y\u00f6ntem, \u00e7o\u011fu kullan\u0131c\u0131 i\u00e7in en kolay ve en h\u0131zl\u0131 yoldur. Ubuntu’nun varsay\u0131lan depolar\u0131nda Suricata’n\u0131n bir s\u00fcr\u00fcm\u00fc bulunsa da, genellikle en g\u00fcncel s\u00fcr\u00fcm olmayabilir. Bu nedenle, OISF’in resmi Suricata deposunu eklemek, en g\u00fcncel kararl\u0131 s\u00fcr\u00fcm\u00fc alman\u0131z\u0131 sa\u011flar.<\/p>\n
Suricata Deposunu Ekleme<\/h5>\n
OISF’in resmi deposunu sisteminize eklemek i\u00e7in a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 izleyin:
\n1.  Gerekli paketleri y\u00fckleyin:<\/strong><\/p>\n
sudo apt install -y software-properties-common apt-transport-https wget<\/code><\/pre>\n
2.  Suricata GPG anahtar\u0131n\u0131 indirin ve ekleyin:<\/strong><\/p>\n
wget -qO - https:\/\/apt.suricata.io\/apt.asc | sudo apt-key add -<\/code><\/pre>\n
3.  Suricata deposunu sources.list.d dizinine ekleyin:<\/strong><\/p>\n
echo \"deb https:\/\/apt.suricata.io\/focal stable main\" | sudo tee \/etc\/apt\/sources.list.d\/suricata.list<\/code><\/pre>\n
    Burada focal<\/code>, Ubuntu 20.04’\u00fcn kod ad\u0131d\u0131r. E\u011fer farkl\u0131 bir Ubuntu s\u00fcr\u00fcm\u00fc kullan\u0131yorsan\u0131z, o s\u00fcr\u00fcm\u00fcn kod ad\u0131n\u0131 kullanman\u0131z gerekir.
\n4.  Paket listesini g\u00fcncelleyin:<\/strong><\/p>\n
sudo apt update<\/code><\/pre>\n
Suricata Paketini Kurma<\/h5>\n
Depoyu ekledikten ve paket listesini g\u00fcncelledikten sonra, Suricata’y\u0131 kurmak art\u0131k \u00e7ok basittir:<\/p>\n
sudo apt install -y suricata<\/code><\/pre>\n
Kurulum tamamland\u0131\u011f\u0131nda, Suricata servisi genellikle otomatik olarak ba\u015flar. Durumunu kontrol etmek i\u00e7in:<\/p>\n
sudo systemctl status suricata<\/code><\/pre>\n
E\u011fer \u00e7al\u0131\u015fm\u0131yorsa, manuel olarak ba\u015flatabilirsiniz:<\/p>\n
sudo systemctl start suricata<\/code><\/pre>\n
Suricata’n\u0131n kurulum dizini genellikle \/etc\/suricata<\/code> ve g\u00fcnl\u00fck dosyalar\u0131 \/var\/log\/suricata<\/code> alt\u0131nda bulunur.<\/p>\n
Kaynak Koddan Kurulum (Daha Geli\u015fmi\u015f ve \u00d6zelle\u015ftirilebilir Y\u00f6ntem)<\/h4>\n
Kaynak koddan kurulum, Suricata’n\u0131n en yeni \u00f6zelliklerini veya belirli bir s\u00fcr\u00fcm\u00fcn\u00fc kullanmak isteyenler i\u00e7in daha fazla esneklik sunar. Ancak, derleme s\u00fcreci daha fazla ad\u0131m ve dikkat gerektirir.<\/p>\n
Gerekli Ba\u011f\u0131ml\u0131l\u0131klar\u0131 Kurma<\/h5>\n
Bu y\u00f6ntemi kullanacaksan\u0131z, “Sistem G\u00fcncelleme ve Ba\u011f\u0131ml\u0131l\u0131klar\u0131n Kurulumu” b\u00f6l\u00fcm\u00fcndeki t\u00fcm ba\u011f\u0131ml\u0131l\u0131klar\u0131 y\u00fckledi\u011finizden emin olun. Bu ad\u0131m, derleme i\u00e7in gerekli t\u00fcm ara\u00e7lar\u0131 ve k\u00fct\u00fcphaneleri sa\u011flar.<\/p>\n
Suricata Kaynak Kodunu \u0130ndirme<\/h5>\n
Suricata’n\u0131n en g\u00fcncel kaynak kodunu GitHub deposundan klonlayabilirsiniz:<\/p>\n
cd \/opt\nsudo git clone https:\/\/github.com\/OISF\/suricata.git\ncd suricata<\/code><\/pre>\n
Belirli bir s\u00fcr\u00fcm\u00fc indirmek isterseniz, git checkout <\/code> komutunu kullanabilirsiniz (\u00f6rne\u011fin, git checkout suricata-6.0.4<\/code>).<\/p>\n
Derleme ve Kurulum<\/h5>\n
Kaynak kodu indirdikten sonra, derleme ve kurulum ad\u0131mlar\u0131na ge\u00e7ebiliriz:
\n1.  Yap\u0131land\u0131rma beti\u011fini \u00e7al\u0131\u015ft\u0131r\u0131n:<\/strong>
\n    Bu ad\u0131m, sisteminizdeki ba\u011f\u0131ml\u0131l\u0131klar\u0131 kontrol eder ve derleme se\u00e7eneklerini ayarlar.<\/p>\n
sudo .\/autogen.sh\n    sudo .\/configure --prefix=\/usr --sysconfdir=\/etc --localstatedir=\/var --enable-nfqueue --enable-lua --enable-geoip --enable-hiredis<\/code><\/pre>\n
    *   --prefix=\/usr<\/code>: Kurulum dizinini belirtir.
\n    *   --sysconfdir=\/etc<\/code>: Yap\u0131land\u0131rma dosyalar\u0131n\u0131n yerini belirtir.
\n    *   --localstatedir=\/var<\/code>: Durum dosyalar\u0131n\u0131n ve g\u00fcnl\u00fcklerin yerini belirtir.
\n    *   --enable-nfqueue<\/code>: IPS modunda Netfilter entegrasyonu i\u00e7in.
\n    *   --enable-lua<\/code>: Lua betik deste\u011fi i\u00e7in.
\n    *   --enable-geoip<\/code>: GeoIP deste\u011fi i\u00e7in.
\n    *   --enable-hiredis<\/code>: Redis entegrasyonu i\u00e7in.
\n    \u0130htiya\u00e7lar\u0131n\u0131za g\u00f6re bu se\u00e7enekleri de\u011fi\u015ftirebilirsiniz.
\n2.  Derleme i\u015flemini ba\u015flat\u0131n:<\/strong><\/p>\n
sudo make<\/code><\/pre>\n
    Bu i\u015flem, sisteminizin donan\u0131m\u0131na ba\u011fl\u0131 olarak biraz zaman alabilir.
\n3.  Kurulumu ger\u00e7ekle\u015ftirin:<\/strong><\/p>\n
sudo make install<\/code><\/pre>\n
    Bu komut, derlenmi\u015f Suricata ikili dosyalar\u0131n\u0131 ve ilgili dosyalar\u0131 sistem dizinlerine kopyalar.
\n4.  Suricata’n\u0131n sistem yolunda oldu\u011fundan emin olun ve k\u00fct\u00fcphane \u00f6nbelle\u011fini g\u00fcncelleyin:<\/strong><\/p>\n
sudo ldconfig<\/code><\/pre>\n
5.  Varsay\u0131lan yap\u0131land\u0131rma dosyalar\u0131n\u0131 kopyalay\u0131n:<\/strong><\/p>\n
sudo cp suricata.yaml \/etc\/suricata\/\n    sudo cp classification.config \/etc\/suricata\/\n    sudo cp reference.config \/etc\/suricata\/<\/code><\/pre>\n
    Bu dosyalar\u0131 kaynak kod dizininden \/etc\/suricata<\/code> alt\u0131na kopyalaman\u0131z gerekir. E\u011fer \/etc\/suricata<\/code> dizini yoksa, olu\u015fturun: sudo mkdir -p \/etc\/suricata<\/code>.
\n6.  systemd servisini yap\u0131land\u0131r\u0131n:<\/strong>
\n    Kaynak koddan kurulumda, Suricata’n\u0131n bir systemd servisi olarak \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flamak i\u00e7in manuel olarak bir servis dosyas\u0131 olu\u015fturman\u0131z gerekebilir.<\/p>\n
sudo cp \/opt\/suricata\/etc\/suricata.service \/etc\/systemd\/system\/\n    sudo systemctl daemon-reload\n    sudo systemctl enable suricata\n    sudo systemctl start suricata<\/code><\/pre>\n
    Bu ad\u0131mlardan sonra Suricata servisi otomatik olarak ba\u015flayacak ve sistem ba\u015flang\u0131c\u0131nda etkinle\u015ftirilecektir.<\/p>\n
Suricata Yap\u0131land\u0131rmas\u0131<\/h3>\n
Suricata’n\u0131n kalbi, \/etc\/suricata\/suricata.yaml<\/code> dosyas\u0131nda bulunan yap\u0131land\u0131rmas\u0131d\u0131r. Bu dosya, Suricata’n\u0131n nas\u0131l \u00e7al\u0131\u015faca\u011f\u0131n\u0131, hangi kurallar\u0131 kullanaca\u011f\u0131n\u0131, g\u00fcnl\u00fckleri nereye yazaca\u011f\u0131n\u0131 ve di\u011fer bir\u00e7ok \u00f6nemli ayar\u0131 belirler.<\/p>\n
Yap\u0131land\u0131rma Dosyas\u0131na Genel Bak\u0131\u015f (suricata.yaml<\/code>)<\/h4>\n
suricata.yaml<\/code> dosyas\u0131 YAML format\u0131nda yaz\u0131lm\u0131\u015ft\u0131r ve olduk\u00e7a kapsaml\u0131d\u0131r. Bir metin d\u00fczenleyici ile a\u00e7\u0131n:<\/p>\n
sudo nano \/etc\/suricata\/suricata.yaml<\/code><\/pre>\n
Dosya i\u00e7indeki yorumlar (#<\/code> ile ba\u015flayan sat\u0131rlar) ayarlar hakk\u0131nda bilgi verir. \u00d6nemli b\u00f6l\u00fcmler \u015funlard\u0131r:<\/p>\n
A\u011f Aray\u00fcz\u00fc Ayarlar\u0131 (Home_Net, External_Net)<\/h4>\n
Bu ayarlar, Suricata’n\u0131n a\u011f\u0131n\u0131z\u0131n i\u00e7 ve d\u0131\u015f k\u0131s\u0131mlar\u0131n\u0131 nas\u0131l tan\u0131mlad\u0131\u011f\u0131n\u0131 belirler ve kural de\u011ferlendirmesi i\u00e7in kritik \u00f6neme sahiptir.
\n*   home-net<\/code>:<\/strong> Korumak istedi\u011finiz i\u00e7 a\u011f\u0131n\u0131z\u0131 tan\u0131mlar. Genellikle yerel a\u011f\u0131n\u0131z\u0131n IP aral\u0131\u011f\u0131d\u0131r.<\/p>\n
home-net: \"[192.168.1.0\/24,10.0.0.0\/8]\" # \u00d6rnek: Yerel a\u011f\u0131n\u0131z\u0131n IP aral\u0131\u011f\u0131<\/code><\/pre>\n
    Birden fazla IP aral\u0131\u011f\u0131 veya tek bir IP adresi belirtebilirsiniz.
\n*   external-net<\/code>:<\/strong> home-net<\/code> d\u0131\u015f\u0131ndaki t\u00fcm a\u011flar\u0131 tan\u0131mlar. Genellikle “any” olarak b\u0131rak\u0131l\u0131r veya belirli d\u0131\u015f a\u011flar belirtilir.<\/p>\n
external-net: \"any\" # Genellikle bu \u015fekilde b\u0131rak\u0131l\u0131r<\/code><\/pre>\n
Bu ayarlar, kurallar\u0131n “kaynak” veya “hedef” olarak HOME_NET<\/code> veya EXTERNAL_NET<\/code> de\u011fi\u015fkenlerini kulland\u0131\u011f\u0131nda nas\u0131l yorumlanaca\u011f\u0131n\u0131 belirler.<\/p>\n
Kural Dosyalar\u0131n\u0131n Y\u00f6netimi<\/h4>\n
Suricata, kural dosyalar\u0131n\u0131 belirli bir dizinden okur. suricata.yaml<\/code> i\u00e7inde rule-files<\/code> b\u00f6l\u00fcm\u00fcn\u00fc bulacaks\u0131n\u0131z:<\/p>\n
rule-files:\n  - suricata.rules # \u00d6rnek kural dosyas\u0131\n  - local.rules    # Kendi \u00f6zel kurallar\u0131n\u0131z i\u00e7in<\/code><\/pre>\n
Varsay\u0131lan olarak, Suricata’n\u0131n kendi kural dosyalar\u0131 ve suricata-update<\/code> ile indirilen kurallar burada belirtilen dizinlerde bulunur. Genellikle \/var\/lib\/suricata\/rules<\/code> veya \/etc\/suricata\/rules<\/code> alt\u0131nda bulunurlar.<\/p>\n
G\u00fcnl\u00fckleme Ayarlar\u0131 (Evebox, JSON, Unified2)<\/h4>\n
Suricata, olaylar\u0131 ve uyar\u0131lar\u0131 farkl\u0131 formatlarda g\u00fcnl\u00fc\u011fe kaydedebilir. En yayg\u0131n kullan\u0131lanlar:
\n*   fast.log<\/code>:<\/strong> H\u0131zl\u0131 ve okunabilir bir formatta uyar\u0131lar\u0131 kaydeder.<\/p>\n
outputs:\n      - fast:\n          enabled: yes\n          filename: fast.log\n          append: yes\n          # level: info<\/code><\/pre>\n
*   eve.json<\/code>:<\/strong> T\u00fcm olaylar\u0131 (uyar\u0131lar, ak\u0131\u015flar, HTTP istekleri, DNS sorgular\u0131 vb.) yap\u0131land\u0131r\u0131lm\u0131\u015f JSON format\u0131nda kaydeder. SIEM sistemleriyle entegrasyon i\u00e7in idealdir.<\/p>\n
outputs:\n      - eve-log:\n          enabled: yes\n          filetype: regular\n          filename: eve.json\n          # community_id: yes # Ak\u0131\u015flar i\u00e7in benzersiz ID olu\u015fturur\n          # append: yes\n          # compression: lz4 # gzip, bzip2, xz, lz4\n          # # level: info<\/code><\/pre>\n
    eve.json<\/code> \u00e7\u0131kt\u0131s\u0131, olaylar\u0131 daha detayl\u0131 incelemek i\u00e7in \u00e7ok de\u011ferlidir.
\n*   drop.log<\/code>:<\/strong> IPS modunda engellenen paketleri kaydeder.
\n*   unified2-alert<\/code>:<\/strong> Snort ile uyumlu bir format.<\/p>\n
Performans Ayarlar\u0131 (runmode, threads)<\/h4>\n
Suricata’n\u0131n performans\u0131n\u0131 optimize etmek i\u00e7in runmode<\/code> ve threading<\/code> ayarlar\u0131 \u00f6nemlidir.
\n*   runmode<\/code>:<\/strong> Suricata’n\u0131n hangi modda \u00e7al\u0131\u015faca\u011f\u0131n\u0131 belirler.<\/p>\n
runmode: autofp # Varsay\u0131lan ve \u00e7o\u011fu zaman en iyi se\u00e7enek<\/code><\/pre>\n
    *   autofp<\/code>: En iyi performans\u0131 sa\u011flamak i\u00e7in Suricata’n\u0131n otomatik olarak i\u015f par\u00e7ac\u0131klar\u0131n\u0131 y\u00f6netmesini sa\u011flar.
\n    *   workers<\/code>: Her a\u011f aray\u00fcz\u00fc i\u00e7in ayr\u0131 bir i\u015f par\u00e7ac\u0131\u011f\u0131 olu\u015fturur.
\n    *   simple<\/code>: Tek i\u015f par\u00e7ac\u0131kl\u0131 mod.
\n*   threading<\/code>:<\/strong> \u0130\u015f par\u00e7ac\u0131\u011f\u0131 say\u0131lar\u0131n\u0131 manuel olarak ayarlayabilirsiniz, ancak autofp<\/code> genellikle yeterlidir.<\/p>\n
threading:\n      set-cpu-affinity: no # CPU \u00e7ekirdeklerine i\u015f par\u00e7ac\u0131klar\u0131n\u0131 sabitleme\n      detect:\n        - management-type: \"auto\"\n          # ... di\u011fer ayarlar<\/code><\/pre>\n
Yap\u0131land\u0131rma Dosyas\u0131n\u0131 Do\u011frulama:<\/strong>
\nHerhangi bir de\u011fi\u015fiklik yapt\u0131ktan sonra, Suricata’n\u0131n yap\u0131land\u0131rma dosyas\u0131n\u0131 do\u011frulaman\u0131z \u00f6nemlidir:<\/p>\n
sudo suricata -T -c \/etc\/suricata\/suricata.yaml -i <\/code><\/pre>\n
\u00d6rnek:<\/p>\n
sudo suricata -T -c \/etc\/suricata\/suricata.yaml -i enp0s3<\/code><\/pre>\n
Bu komut, yap\u0131land\u0131rma dosyas\u0131nda herhangi bir hata olup olmad\u0131\u011f\u0131n\u0131 kontrol eder. E\u011fer “Configuration OK” mesaj\u0131n\u0131 g\u00f6r\u00fcrseniz, her \u015fey yolundad\u0131r.<\/p>\n
Kural Y\u00f6netimi ve G\u00fcncelleme<\/h3>\n
Suricata’n\u0131n etkinli\u011fi, kulland\u0131\u011f\u0131 kural setlerinin g\u00fcncelli\u011fine ve kalitesine ba\u011fl\u0131d\u0131r. Suricata, \u00e7e\u015fitli kural setlerini destekler ve suricata-update<\/code> arac\u0131yla bu kurallar\u0131 kolayca y\u00f6netmenizi sa\u011flar.<\/p>\n
Varsay\u0131lan Kural Setleri (Emerging Threats, Proofpoint ET Open)<\/h4>\n
Suricata, Snort kurallar\u0131 ile uyumlu oldu\u011fu i\u00e7in, Snort taraf\u0131ndan da kullan\u0131lan bir\u00e7ok kural setini kullanabilir. En pop\u00fcler a\u00e7\u0131k kaynak kural seti, Proofpoint taraf\u0131ndan sa\u011flanan Emerging Threats (ET Open)<\/strong> kurallar\u0131d\u0131r. Bu kurallar, bilinen bir\u00e7ok sald\u0131r\u0131, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m ve a\u011f anormalli\u011fi i\u00e7in imzalar i\u00e7erir.<\/p>\n
Suricata-Update Arac\u0131<\/h4>\n
suricata-update<\/code>, Suricata kural setlerini indirmek, g\u00fcncellemek ve y\u00f6netmek i\u00e7in resmi bir ara\u00e7t\u0131r.
\n1.  Kurulum:<\/strong> suricata-update<\/code> genellikle Suricata ile birlikte gelir veya Python pip ile kurulabilir.<\/p>\n
sudo pip3 install suricata-update<\/code><\/pre>\n
2.  Kural Kaynaklar\u0131n\u0131 Yap\u0131land\u0131rma:<\/strong> suricata-update<\/code>‘in hangi kural setlerini indirece\u011fini belirlemeniz gerekir. Varsay\u0131lan olarak, ET Open kurallar\u0131 etkindir. Di\u011fer kural setlerini etkinle\u015ftirmek veya devre d\u0131\u015f\u0131 b\u0131rakmak i\u00e7in suricata-update --list-sources<\/code> komutunu kullanabilirsiniz.<\/p>\n
sudo suricata-update --list-sources<\/code><\/pre>\n
    \u00d6rne\u011fin, ET Open kurallar\u0131n\u0131 etkinle\u015ftirmek i\u00e7in:<\/p>\n
sudo suricata-update enable-source et\/open<\/code><\/pre>\n
3.  Kurallar\u0131 G\u00fcncelleme:<\/strong> Kurallar\u0131 indirmek veya g\u00fcncellemek i\u00e7in a\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n
sudo suricata-update<\/code><\/pre>\n
    Bu komut, belirtilen kaynaklardan en son kurallar\u0131 indirir, Suricata i\u00e7in uygun formatta derler ve \/var\/lib\/suricata\/rules\/suricata.rules<\/code> (veya yap\u0131land\u0131rman\u0131zda belirtilen di\u011fer dizinlere) kaydeder.
\n4.  Suricata’y\u0131 Yeniden Ba\u015flatma:<\/strong> Yeni kurallar\u0131n etkin olmas\u0131 i\u00e7in Suricata servisini yeniden ba\u015flatman\u0131z gerekir:<\/p>\n
sudo systemctl restart suricata<\/code><\/pre>\n
Otomatik Kural G\u00fcncelleme:<\/strong>
\nKurallar\u0131 d\u00fczenli olarak g\u00fcncel tutmak \u00f6nemlidir. Bunu otomatikle\u015ftirmek i\u00e7in bir cron i\u015fi olu\u015fturabilirsiniz:<\/p>\n
sudo crontab -e<\/code><\/pre>\n
A\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin (\u00f6rne\u011fin, her g\u00fcn sabah 3’te g\u00fcncelleme yapar):<\/p>\n
0 3  <\/em> * \/usr\/bin\/suricata-update && systemctl restart suricata<\/code><\/pre>\n
Bu, Suricata’n\u0131n her g\u00fcn en son tehdit imzalar\u0131yla g\u00fcncel kalmas\u0131n\u0131 sa\u011flar.<\/p>\n
\u00d6zel Kural Olu\u015fturma (Basit bir \u00f6rnek)<\/h4>\n
Kendi \u00f6zel kurallar\u0131n\u0131z\u0131 yazarak Suricata’n\u0131n alg\u0131lama yeteneklerini geni\u015fletebilirsiniz. \u00d6zel kurallar genellikle \/etc\/suricata\/rules\/local.rules<\/code> gibi ayr\u0131 bir dosyada saklan\u0131r.
\n\u00d6rnek bir kural:<\/p>\n
alert tcp any any -> $HOME_NET 80 (msg:\"HTTP: Custom Test Rule - Access to Port 80\"; flow:to_client,established; content:\"User-Agent|3A| CustomAgent\"; nocase; sid:1000001; rev:1;)<\/code><\/pre>\n
Bu kural, User-Agent<\/code> ba\u015fl\u0131\u011f\u0131nda “CustomAgent” i\u00e7eren herhangi bir HTTP trafi\u011fini (port 80) tespit etti\u011finde bir uyar\u0131 olu\u015fturur.
\n*   alert<\/code>: Kural tetiklendi\u011finde uyar\u0131 olu\u015ftur.
\n*   tcp any any -> $HOME_NET 80<\/code>: Herhangi bir kaynaktan $HOME_NET<\/code> i\u00e7indeki port 80’e giden TCP trafi\u011fi.
\n*   msg<\/code>: Uyar\u0131 mesaj\u0131.
\n*   flow<\/code>: Ak\u0131\u015f y\u00f6n\u00fc ve durumu.
\n*   content<\/code>: Aranacak i\u00e7erik.
\n*   nocase<\/code>: B\u00fcy\u00fck\/k\u00fc\u00e7\u00fck harf duyars\u0131z arama.
\n*   sid<\/code>: Kural\u0131n benzersiz kimli\u011fi (1000000’dan b\u00fcy\u00fck say\u0131lar \u00f6zel kurallar i\u00e7in \u00f6nerilir).
\n*   rev<\/code>: Kural\u0131n revizyon numaras\u0131.<\/p>\n
\u00d6zel kurallar\u0131n\u0131z\u0131 ekledikten sonra, suricata.yaml<\/code> dosyas\u0131nda local.rules<\/code> dosyas\u0131n\u0131n belirtildi\u011finden emin olun ve Suricata’y\u0131 yeniden ba\u015flat\u0131n.<\/p>\n
Suricata’y\u0131 Ba\u015flatma ve Y\u00f6netme<\/h3>\n
Suricata, systemd ile entegre bir servis olarak \u00e7al\u0131\u015f\u0131r, bu da onu kolayca y\u00f6netmenizi sa\u011flar.<\/p>\n
Servisi Ba\u015flatma, Durdurma, Yeniden Ba\u015flatma<\/h4>\n
*   Ba\u015flatma:<\/strong><\/p>\n
sudo systemctl start suricata<\/code><\/pre>\n
*   Durdurma:<\/strong><\/p>\n
sudo systemctl stop suricata<\/code><\/pre>\n
*   Yeniden Ba\u015flatma:<\/strong> (Yap\u0131land\u0131rma veya kural de\u011fi\u015fikliklerinden sonra)<\/p>\n
sudo systemctl restart suricata<\/code><\/pre>\n
Servis Durumunu Kontrol Etme<\/h4>\n
Suricata servisinin \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 ve herhangi bir hata olup olmad\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in:<\/p>\n
sudo systemctl status suricata<\/code><\/pre>\n
Bu komut, servisin aktif olup olmad\u0131\u011f\u0131n\u0131, son g\u00fcnl\u00fck mesajlar\u0131n\u0131 ve varsa hatalar\u0131 g\u00f6sterir.<\/p>\n
Canl\u0131 Test Modu (IDS\/IPS modlar\u0131)<\/h4>\n
Suricata’y\u0131 IDS (Sald\u0131r\u0131 Tespit Sistemi) modunda \u00e7al\u0131\u015ft\u0131rmak i\u00e7in:<\/p>\n
sudo suricata -c \/etc\/suricata\/suricata.yaml -i <\/code><\/pre>\n
\u00d6rnek:<\/p>\n
sudo suricata -c \/etc\/suricata\/suricata.yaml -i enp0s3<\/code><\/pre>\n
Bu komut, Suricata’y\u0131 \u00f6n planda \u00e7al\u0131\u015ft\u0131r\u0131r ve uyar\u0131lar\u0131 do\u011frudan konsola basar. Test ve hata ay\u0131klama i\u00e7in kullan\u0131\u015fl\u0131d\u0131r.<\/p>\n
Suricata’y\u0131 IPS (Sald\u0131r\u0131 \u00d6nleme Sistemi) modunda \u00e7al\u0131\u015ft\u0131rmak i\u00e7in Netfilter (nfqueue) entegrasyonunu kullanman\u0131z gerekir. \u00d6ncelikle nfqueue<\/code> deste\u011fi ile derledi\u011finizden emin olun (kaynak koddan kurulumda --enable-nfqueue<\/code> veya APT s\u00fcr\u00fcm\u00fcnde bu \u00f6zelli\u011fin mevcut oldu\u011funu kontrol edin).
\nIPS modunda Suricata, a\u011f trafi\u011fini yakalar, kurallara g\u00f6re analiz eder ve k\u00f6t\u00fc niyetli trafi\u011fi engeller. Bunun i\u00e7in iptables<\/code> kurallar\u0131 ile Suricata’ya trafik y\u00f6nlendirmeniz gerekir.
\n1.  Suricata’y\u0131 nfqueue modunda ba\u015flat\u0131n:<\/strong><\/p>\n
sudo suricata -c \/etc\/suricata\/suricata.yaml --nfqueue-num 0<\/code><\/pre>\n
    Burada 0<\/code>, Suricata’n\u0131n dinleyece\u011fi nfqueue numaras\u0131n\u0131 belirtir.
\n2.  iptables<\/code> kurallar\u0131n\u0131 ekleyin:<\/strong>
\n    T\u00fcm trafi\u011fi (veya belirli trafi\u011fi) Suricata’ya y\u00f6nlendirmek i\u00e7in iptables<\/code> kurallar\u0131 kullan\u0131n.<\/p>\n
sudo iptables -I FORWARD -j NFQUEUE --queue-num 0\n    sudo iptables -I INPUT -j NFQUEUE --queue-num 0\n    sudo iptables -I OUTPUT -j NFQUEUE --queue-num 0<\/code><\/pre>\n
    Bu kurallar, t\u00fcm gelen, giden ve iletilen trafi\u011fi Suricata’n\u0131n dinledi\u011fi 0 numaral\u0131 kuyru\u011fa y\u00f6nlendirir. Suricata, bu kuyruktaki paketleri i\u015fler ve kural setine g\u00f6re izin verir veya engeller.
\n    UYARI:<\/strong> IPS modunu dikkatli kullan\u0131n. Yanl\u0131\u015f yap\u0131land\u0131rma, a\u011f trafi\u011fini tamamen kesebilir. Test ortam\u0131nda denemeden canl\u0131 sistemlerde kullanmay\u0131n.<\/p>\n
Suricata ile Log Analizi ve \u0130zleme<\/h3>\n
Suricata’n\u0131n \u00fcretti\u011fi g\u00fcnl\u00fckler, a\u011f\u0131n\u0131zda neler olup bitti\u011fini anlamak i\u00e7in hayati \u00f6neme sahiptir. Bu g\u00fcnl\u00fckler, g\u00fcvenlik olaylar\u0131n\u0131 tespit etmenize ve analiz etmenize yard\u0131mc\u0131 olur.<\/p>\n
fast.log<\/code> ve eve.json<\/code> dosyalar\u0131n\u0131n incelenmesi<\/h4>\n
*   fast.log<\/code>:<\/strong> H\u0131zl\u0131 bir genel bak\u0131\u015f i\u00e7in idealdir. Uyar\u0131 mesajlar\u0131n\u0131, zaman damgalar\u0131n\u0131 ve kaynak\/hedef IP adreslerini i\u00e7erir.<\/p>\n
sudo tail -f \/var\/log\/suricata\/fast.log<\/code><\/pre>\n
    Bu komut, fast.log<\/code> dosyas\u0131na yeni yaz\u0131lan sat\u0131rlar\u0131 ger\u00e7ek zamanl\u0131 olarak g\u00f6sterir.
\n*   eve.json<\/code>:<\/strong> Daha detayl\u0131 analiz i\u00e7in kullan\u0131l\u0131r. JSON format\u0131nda oldu\u011fu i\u00e7in makine taraf\u0131ndan kolayca ayr\u0131\u015ft\u0131r\u0131labilir ve SIEM sistemleri i\u00e7in \u00e7ok uygundur.<\/p>\n
sudo tail -f \/var\/log\/suricata\/eve.json | jq .<\/code><\/pre>\n
    jq<\/code> arac\u0131 (JSON i\u015flemcisi), eve.json<\/code> \u00e7\u0131kt\u0131s\u0131n\u0131 daha okunabilir bir hale getirir. jq<\/code> y\u00fckl\u00fc de\u011filse sudo apt install -y jq<\/code> ile y\u00fckleyebilirsiniz.
\n    eve.json<\/code> \u00e7\u0131kt\u0131s\u0131nda, event_type<\/code> alan\u0131 olay\u0131n t\u00fcr\u00fcn\u00fc (alert, http, dns, flow, tls vb.) belirtir. alert<\/code> olaylar\u0131, Suricata’n\u0131n bir kural\u0131 tetikledi\u011fi durumlar\u0131 g\u00f6sterir.<\/p>\n
tail -f<\/code> kullan\u0131m\u0131<\/h4>\n
tail -f<\/code> komutu, g\u00fcnl\u00fck dosyalar\u0131n\u0131 ger\u00e7ek zamanl\u0131 olarak izlemek i\u00e7in vazge\u00e7ilmezdir. \u00d6zellikle yeni kurallar test ederken veya a\u011fdaki \u015f\u00fcpheli etkinlikleri an\u0131nda g\u00f6rmek istedi\u011finizde \u00e7ok faydal\u0131d\u0131r.<\/p>\n
Log Y\u00f6netim Sistemleri (ELK Stack, Splunk) ile Entegrasyon<\/h4>\n
B\u00fcy\u00fck a\u011flarda, Suricata’n\u0131n \u00fcretti\u011fi g\u00fcnl\u00fckleri manuel olarak incelemek s\u00fcrd\u00fcr\u00fclebilir de\u011fildir. Bu noktada, log y\u00f6netim sistemleri (SIEM) devreye girer.
\n*   ELK Stack (Elasticsearch, Logstash, Kibana):<\/strong> Suricata’n\u0131n eve.json<\/code> \u00e7\u0131kt\u0131s\u0131n\u0131 Logstash ile parse edip Elasticsearch’e g\u00f6nderebilir, ard\u0131ndan Kibana ile g\u00f6rselle\u015ftirebilirsiniz. Bu, g\u00fcvenlik olaylar\u0131n\u0131 merkezi bir yerden izlemek ve analiz etmek i\u00e7in g\u00fc\u00e7l\u00fc bir \u00e7\u00f6z\u00fcmd\u00fcr.
\n*   Splunk:<\/strong> Ticari bir SIEM \u00e7\u00f6z\u00fcm\u00fc olan Splunk da Suricata g\u00fcnl\u00fcklerini alabilir ve geli\u015fmi\u015f analiz yetenekleri sunar.
\nBu entegrasyonlar, Suricata’n\u0131n \u00fcretti\u011fi zengin veriyi anlaml\u0131 g\u00fcvenlik istihbarat\u0131na d\u00f6n\u00fc\u015ft\u00fcrmek i\u00e7in kritik \u00f6neme sahiptir.<\/p>\n
Performans Optimizasyonu ve En \u0130yi Uygulamalar<\/h3>\n
Suricata’n\u0131n performans\u0131, a\u011f\u0131n\u0131z\u0131n boyutuna ve trafik hacmine g\u00f6re optimize edilmelidir. Yanl\u0131\u015f yap\u0131land\u0131rma, paket d\u00fc\u015fmelerine veya kaynak yetersizli\u011fine yol a\u00e7abilir.<\/p>\n
Donan\u0131m Optimizasyonu<\/h4>\n
*   CPU \u00c7ekirdekleri:<\/strong> Suricata’n\u0131n \u00e7ok i\u015f par\u00e7ac\u0131kl\u0131 yap\u0131s\u0131, birden fazla CPU \u00e7ekirde\u011finden tam olarak yararlan\u0131r. M\u00fcmk\u00fcn oldu\u011funca fazla \u00e7ekirde\u011fe sahip bir sistem kullan\u0131n.
\n*   RAM:<\/strong> Yeterli RAM, kural setlerini ve oturum durumlar\u0131n\u0131 bellekte tutmak i\u00e7in kritiktir.
\n*   SSD Disk:<\/strong> G\u00fcnl\u00fck yazma i\u015flemleri yo\u011fun olabilece\u011fi i\u00e7in h\u0131zl\u0131 bir SSD kullanmak, I\/O performans\u0131n\u0131 art\u0131r\u0131r.
\n*   NIC Kartlar\u0131:<\/strong> Y\u00fcksek h\u0131zl\u0131 (Gigabit veya 10 Gigabit) NIC’ler, paket yakalama performans\u0131n\u0131 art\u0131r\u0131r.<\/p>\n
Kural Seti Optimizasyonu<\/h4>\n
*   Gereksiz Kurallar\u0131 Devre D\u0131\u015f\u0131 B\u0131rakma:<\/strong> Kullanmad\u0131\u011f\u0131n\u0131z veya a\u011f\u0131n\u0131z i\u00e7in alakas\u0131z olan kural setlerini veya tek tek kurallar\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131n. Her kural, Suricata’n\u0131n i\u015f y\u00fck\u00fcne katk\u0131da bulunur.
\n*   \u00d6zel Kurallar:<\/strong> Kendi \u00f6zel kurallar\u0131n\u0131z\u0131 yazarken, performans dostu kurallar yazmaya \u00f6zen g\u00f6sterin. \u00d6rne\u011fin, geni\u015f kapsaml\u0131 “any any” kurallar yerine daha spesifik IP adresleri ve portlar kullan\u0131n.
\n*   Kural Gruplar\u0131:<\/strong> Suricata, kural gruplar\u0131n\u0131 optimize etmek i\u00e7in motorunda mekanizmalar bar\u0131nd\u0131r\u0131r.<\/p>\n
Af_packet ve PF_RING Kullan\u0131m\u0131 (K\u0131sa bilgi)<\/h4>\n
Y\u00fcksek trafikli a\u011flarda, Suricata’n\u0131n varsay\u0131lan pcap<\/code> yakalama motoru yeterli gelmeyebilir. Bu durumda, daha geli\u015fmi\u015f yakalama y\u00f6ntemleri kullan\u0131labilir:
\n*   AF_PACKET:<\/strong> Linux \u00e7ekirde\u011finin kendi bir \u00f6zelli\u011fidir ve pcap<\/code>‘e g\u00f6re daha performansl\u0131d\u0131r. Suricata, af-packet<\/code> modunda birden fazla i\u015f par\u00e7ac\u0131\u011f\u0131 kullanarak paketleri yakalayabilir ve i\u015fleyebilir. suricata.yaml<\/code> dosyas\u0131nda af-packet<\/code> b\u00f6l\u00fcm\u00fcn\u00fc etkinle\u015ftirerek kullanabilirsiniz.
\n*   PF_RING:<\/strong> ZC (Zero Copy) modunda \u00e7ok y\u00fcksek performansl\u0131 paket yakalama sa\u011flayan ticari bir k\u00fct\u00fcphanedir. PF_RING, \u00f6zellikle 10 Gigabit ve \u00fczeri a\u011flarda Suricata’n\u0131n performans\u0131n\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131rabilir. Ancak, kurulumu daha karma\u015f\u0131kt\u0131r ve baz\u0131 s\u00fcr\u00fcmleri lisans gerektirebilir.<\/p>\n
Suricata’y\u0131 IPS Modunda Kullanma (Inline Mode)<\/h4>\n
IPS modunda Suricata, a\u011f trafi\u011fini aktif olarak engeller. Bu, a\u011f g\u00fcvenlik duru\u015funuzu \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131rabilir ancak dikkatli yap\u0131land\u0131rma gerektirir.
\n*   Netfilter (NFQUEUE):<\/strong> Linux \u00e7ekirde\u011finin Netfilter (iptables) mekanizmas\u0131 ile entegrasyon, Suricata’n\u0131n IPS modunda \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar. Trafik belirli bir kuyru\u011fa y\u00f6nlendirilir, Suricata bu kuyruktan paketleri al\u0131r, inceler ve karara g\u00f6re paketi geri g\u00f6nderir veya d\u00fc\u015f\u00fcr\u00fcr.
\n*   Performans Etkisi:<\/strong> IPS modunda Suricata, her paketi analiz edip bir karar vermesi gerekti\u011fi i\u00e7in ek bir gecikme (latency) yarat\u0131r. Bu nedenle, y\u00fcksek performansl\u0131 donan\u0131m ve optimize edilmi\u015f kural setleri kritik \u00f6neme sahiptir.
\n*   Yedeklilik:<\/strong> IPS modunda \u00e7al\u0131\u015fan Suricata cihaz\u0131n\u0131n ar\u0131zalanmas\u0131 durumunda a\u011f trafi\u011finin kesilmemesi i\u00e7in yedeklilik \u00e7\u00f6z\u00fcmleri (\u00f6rne\u011fin, bypass a\u011f kartlar\u0131) d\u00fc\u015f\u00fcn\u00fclmelidir.<\/p>\n
Yayg\u0131n Sorunlar ve \u00c7\u00f6z\u00fcmleri<\/h3>\n
Suricata kurulumu ve y\u00f6netimi s\u0131ras\u0131nda kar\u015f\u0131la\u015fabilece\u011finiz baz\u0131 yayg\u0131n sorunlar ve bunlar\u0131n olas\u0131 \u00e7\u00f6z\u00fcmleri a\u015fa\u011f\u0131dad\u0131r:<\/p>\n
Kural G\u00fcncelleme Hatalar\u0131<\/h4>\n
*   Sorun:<\/strong> suricata-update<\/code> \u00e7al\u0131\u015fm\u0131yor veya kural indiremiyor.
\n*   \u00c7\u00f6z\u00fcm:<\/strong>
\n    *   \u0130nternet ba\u011flant\u0131n\u0131z\u0131 kontrol edin.
\n    *   Kural kaynaklar\u0131n\u0131n do\u011fru yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131ndan emin olun (suricata-update --list-sources<\/code>).
\n    *   suricata-update<\/code> arac\u0131n\u0131n en g\u00fcncel s\u00fcr\u00fcm\u00fcn\u00fc kulland\u0131\u011f\u0131n\u0131zdan emin olun (sudo pip3 install --upgrade suricata-update<\/code>).
\n    *   Depo anahtarlar\u0131n\u0131n ve depo URL’sinin do\u011fru oldu\u011fundan emin olun.<\/p>\n
Performans D\u00fc\u015f\u00fc\u015f\u00fc<\/h4>\n
*   Sorun:<\/strong> Suricata y\u00fcksek CPU veya RAM kullan\u0131m\u0131 sergiliyor, paket d\u00fc\u015fmeleri ya\u015fan\u0131yor.
\n*   \u00c7\u00f6z\u00fcm:<\/strong>
\n    *   suricata.yaml<\/code> dosyas\u0131ndaki runmode<\/code> ve threading<\/code> ayarlar\u0131n\u0131 kontrol edin. autofp<\/code> genellikle en iyi ba\u015flang\u0131\u00e7 noktas\u0131d\u0131r.
\n    *   Gereksiz kural setlerini veya tek tek kurallar\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131n.
\n    *   Daha performansl\u0131 yakalama motorlar\u0131na ge\u00e7meyi d\u00fc\u015f\u00fcn\u00fcn (AF_PACKET veya PF_RING).
\n    *   Sistem kaynaklar\u0131n\u0131 (CPU, RAM) y\u00fckseltmeyi d\u00fc\u015f\u00fcn\u00fcn.
\n    *   top<\/code>, htop<\/code>, iftop<\/code> gibi ara\u00e7larla sistem kaynak kullan\u0131m\u0131n\u0131 izleyin.<\/p>\n
A\u011f Trafi\u011fi Yakalama Sorunlar\u0131<\/h4>\n
*   Sorun:<\/strong> Suricata hi\u00e7bir trafik yakalam\u0131yor veya \u00e7ok az trafik g\u00f6r\u00fcyor.
\n*   \u00c7\u00f6z\u00fcm:<\/strong>
\n    *   Suricata’n\u0131n dinledi\u011fi a\u011f aray\u00fcz\u00fcn\u00fcn ad\u0131n\u0131n do\u011fru oldu\u011fundan emin olun (suricata -c ... -i <\/code>).
\n    *   Aray\u00fcz\u00fcn promiscuous modda oldu\u011fundan emin olun (sudo ip link set dev  promisc on<\/code>).
\n    *   Fiziksel ba\u011flant\u0131y\u0131 ve a\u011f anahtar\u0131n\u0131n (switch) port yans\u0131tma (port mirroring\/SPAN) ayarlar\u0131n\u0131 kontrol edin. Suricata’n\u0131n t\u00fcm trafi\u011fi g\u00f6rmesi i\u00e7in bu ayar gereklidir.
\n    *   tcpdump -i <\/code> komutuyla aray\u00fczden trafik ge\u00e7ip ge\u00e7medi\u011fini kontrol edin.<\/p>\n
Suricata Servisi Ba\u015flam\u0131yor<\/h4>\n
*   Sorun:<\/strong> sudo systemctl start suricata<\/code> komutundan sonra servis ba\u015flam\u0131yor veya hemen duruyor.
\n*   \u00c7\u00f6z\u00fcm:<\/strong>
\n    *   sudo systemctl status suricata<\/code> komutuyla servis durumunu ve hata mesajlar\u0131n\u0131 kontrol edin.
\n    *   sudo journalctl -xe | grep suricata<\/code> komutuyla detayl\u0131 g\u00fcnl\u00fckleri inceleyin.
\n    *   suricata.yaml<\/code> yap\u0131land\u0131rma dosyas\u0131n\u0131 sudo suricata -T<\/code> komutuyla do\u011frulay\u0131n. Yap\u0131land\u0131rma hatas\u0131 varsa, d\u00fczeltin.
\n    *   Gerekli ba\u011f\u0131ml\u0131l\u0131klar\u0131n y\u00fckl\u00fc oldu\u011fundan emin olun.
\n    *   Kural dosyalar\u0131n\u0131n do\u011fru yolda oldu\u011fundan ve okunabilir izinlere sahip oldu\u011fundan emin olun.<\/p>\n
Sonu\u00e7 ve \u0130leri Ad\u0131mlar<\/h3>\n
Bu kapsaml\u0131 rehberde, Suricata’y\u0131 Ubuntu 20.04 \u00fczerine kurma, yap\u0131land\u0131rma ve y\u00f6netme s\u00fcre\u00e7lerini detayl\u0131 bir \u015fekilde ele ald\u0131k. Suricata, a\u011f g\u00fcvenli\u011finizi g\u00fc\u00e7lendirmek i\u00e7in g\u00fc\u00e7l\u00fc ve esnek bir ara\u00e7t\u0131r. Do\u011fru kurulum ve yap\u0131land\u0131rma ile a\u011f\u0131n\u0131zdaki k\u00f6t\u00fc niyetli etkinlikleri proaktif bir \u015fekilde tespit edebilir ve hatta \u00f6nleyebilirsiniz.<\/p>\n
Suricata’y\u0131 kurmak sadece ba\u015flang\u0131\u00e7t\u0131r. Ger\u00e7ek de\u011ferini, onu s\u00fcrekli izleyerek, kurallar\u0131n\u0131 g\u00fcncelleyerek ve \u00fcretti\u011fi g\u00fcnl\u00fckleri analiz ederek elde edersiniz.<\/p>\n
\u0130leri Ad\u0131mlar:<\/strong>
\n1.  G\u00fcnl\u00fck Y\u00f6netimi ve G\u00f6rselle\u015ftirme:<\/strong> Suricata’n\u0131n \u00fcretti\u011fi eve.json<\/code> g\u00fcnl\u00fcklerini bir ELK Stack (Elasticsearch, Logstash, Kibana) veya Splunk gibi bir SIEM sistemine entegre ederek olaylar\u0131 merkezi bir konumdan izleyin ve g\u00f6rselle\u015ftirin.
\n2.  \u00d6zel Kural Geli\u015ftirme:<\/strong> A\u011f\u0131n\u0131z\u0131n \u00f6zel ihtiya\u00e7lar\u0131na veya kar\u015f\u0131la\u015ft\u0131\u011f\u0131n\u0131z benzersiz tehditlere y\u00f6nelik kendi Suricata kurallar\u0131n\u0131z\u0131 yazmay\u0131 \u00f6\u011frenin.
\n3.  Performans Ayarlama:<\/strong> A\u011f trafi\u011finizin hacmine ve t\u00fcr\u00fcne g\u00f6re Suricata’n\u0131n performans ayarlar\u0131n\u0131 (AF_PACKET, PF_RING, i\u015f par\u00e7ac\u0131\u011f\u0131 ayarlar\u0131) daha da optimize edin.
\n4.  IPS Modu Uygulamas\u0131:<\/strong> Dikkatli bir \u015fekilde test ortam\u0131nda denemeler yaparak Suricata’y\u0131 IPS modunda kullanma becerilerinizi geli\u015ftirin ve potansiyel olarak canl\u0131 a\u011f\u0131n\u0131zda uygulay\u0131n.
\n5.  Otomasyon:<\/strong> suricata-update<\/code> gibi ara\u00e7lar\u0131 kullanarak kural g\u00fcncellemelerini ve Suricata’n\u0131n yeniden ba\u015flat\u0131lmas\u0131n\u0131 otomatikle\u015ftirmek, y\u00f6netim y\u00fck\u00fcn\u00fc azaltacakt\u0131r.
\n6.  S\u00fcrekli \u00d6\u011frenme:<\/strong> Siber g\u00fcvenlik alan\u0131 s\u00fcrekli de\u011fi\u015fti\u011fi i\u00e7in, Suricata’n\u0131n yeni \u00f6zelliklerini ve en iyi uygulamalar\u0131n\u0131 takip etmeye devam edin.<\/p>\n
Suricata, do\u011fru kullan\u0131ld\u0131\u011f\u0131nda a\u011f savunman\u0131z i\u00e7in vazge\u00e7ilmez bir varl\u0131k haline gelebilir. Bu rehberdeki ad\u0131mlar\u0131 takip ederek, a\u011f\u0131n\u0131z\u0131 daha g\u00fcvenli hale getirme yolunda \u00f6nemli bir ad\u0131m atm\u0131\u015f olacaks\u0131n\u0131z.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Suricata’y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m\nGiri\u015f: A\u011f G\u00fcvenli\u011finde Suricata’n\u0131n Rol\u00fc\nG\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla geli","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1468],"tags":[],"class_list":{"0":"post-34122","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ubuntu","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nSuricata'y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Suricata'y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m\" \/>\n<meta property=\"og:description\" content=\"Suricata'y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m Giri\u015f: A\u011f G\u00fcvenli\u011finde Suricata'n\u0131n Rol\u00fc G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla geli\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-11T09:41:05+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"25 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Suricata’y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m\",\"datePublished\":\"2025-11-11T09:41:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/\"},\"wordCount\":4310,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Ubuntu\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/\",\"name\":\"Suricata'y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-11-11T09:41:05+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Suricata’y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Suricata'y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/","og_locale":"tr_TR","og_type":"article","og_title":"Suricata'y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m","og_description":"Suricata'y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m Giri\u015f: A\u011f G\u00fcvenli\u011finde Suricata'n\u0131n Rol\u00fc G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla geli","og_url":"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-11-11T09:41:05+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"25 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Suricata’y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m","datePublished":"2025-11-11T09:41:05+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/"},"wordCount":4310,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Ubuntu"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/","url":"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/","name":"Suricata'y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-11-11T09:41:05+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/suricatayi-ubuntu-20-04-uzerine-kurulum-rehberi-kapsamli-bir-yaklasim\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Suricata’y\u0131 Ubuntu 20.04 \u00dczerine Kurulum Rehberi: Kapsaml\u0131 Bir Yakla\u015f\u0131m"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/34122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=34122"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/34122\/revisions"}],"predecessor-version":[{"id":34123,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/34122\/revisions\/34123"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=34122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=34122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=34122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}