G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla dijitalle\u015fen d\u00fcnyas\u0131nda siber g\u00fcvenlik tehditleri, bireylerden b\u00fcy\u00fck kurumsal yap\u0131lara kadar her \u00f6l\u00e7ekteki organizasyon i\u00e7in ciddi bir endi\u015fe kayna\u011f\u0131 haline gelmi\u015ftir. Geli\u015fmi\u015f kal\u0131c\u0131 tehditler (APT’ler), fidye yaz\u0131l\u0131mlar\u0131, oltalama sald\u0131r\u0131lar\u0131 ve s\u0131f\u0131r\u0131nc\u0131 g\u00fcn a\u00e7\u0131klar\u0131 gibi tehditler, geleneksel g\u00fcvenlik \u00f6nlemlerini yetersiz k\u0131labilmektedir. Bu noktada, a\u011f tabanl\u0131 g\u00fcvenlik \u00e7\u00f6z\u00fcmleri, \u00f6zellikle de Sald\u0131r\u0131 Tespit Sistemleri (IDS) ve Sald\u0131r\u0131 \u00d6nleme Sistemleri (IPS), hayati bir rol oynamaktad\u0131r. Suricata, a\u00e7\u0131k kaynakl\u0131, y\u00fcksek performansl\u0131 ve \u00e7ok i\u015f par\u00e7ac\u0131kl\u0131 bir a\u011f tehdit alg\u0131lama motoru olarak hem IDS hem de IPS yetenekleri sunar. Bu makale, Suricata’y\u0131 Debian 11 i\u015fletim sistemi \u00fczerinde bir Sald\u0131r\u0131 \u00d6nleme Sistemi (IPS) olarak nas\u0131l yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klamaktad\u0131r. Debian 11’in kararl\u0131l\u0131\u011f\u0131 ve g\u00fcvenilirli\u011fi, Suricata gibi kritik bir g\u00fcvenlik bile\u015fenini bar\u0131nd\u0131rmak i\u00e7in ideal bir platform sunar. Amac\u0131m\u0131z, a\u011f\u0131n\u0131z\u0131 bilinen ve bilinmeyen tehditlere kar\u015f\u0131 aktif olarak koruyacak sa\u011flam bir IPS \u00e7\u00f6z\u00fcm\u00fc olu\u015fturmakt\u0131r.<\/p>\n
Suricata, OISF (Open Information Security Foundation) taraf\u0131ndan geli\u015ftirilen, a\u00e7\u0131k kaynakl\u0131, y\u00fcksek performansl\u0131 bir a\u011f tehdit alg\u0131lama ve \u00f6nleme motorudur. Geleneksel IDS\/IPS sistemlerinden farkl\u0131 olarak, Suricata, \u00e7oklu i\u015f par\u00e7ac\u0131kl\u0131 (multi-threaded) mimarisi sayesinde modern \u00e7ok \u00e7ekirdekli i\u015flemcilerin g\u00fcc\u00fcnden tam olarak faydalanabilir. Bu, onu y\u00fcksek bant geni\u015fli\u011fine sahip a\u011f ortamlar\u0131nda bile etkili k\u0131lar.<\/p>\n
Suricata’n\u0131n temel \u00f6zellikleri \u015funlard\u0131r: Suricata, \u00f6zellikle a\u011f ge\u00e7itlerinde veya kritik a\u011f segmentlerinde konumland\u0131r\u0131larak, d\u0131\u015far\u0131dan gelen tehditleri veya i\u00e7eriden kaynaklanan anormallikleri tespit edip \u00f6nlemede g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r.<\/p>\n Siber g\u00fcvenlik d\u00fcnyas\u0131nda s\u0131kl\u0131kla kar\u015f\u0131la\u015f\u0131lan iki temel kavram olan IDS ve IPS, a\u011f g\u00fcvenli\u011fini sa\u011flamak i\u00e7in farkl\u0131 yakla\u015f\u0131mlar sunar. Suricata her iki modu da destekledi\u011fi i\u00e7in, bu fark\u0131 anlamak \u00f6nemlidir.<\/p>\n Bir IDS, a\u011f trafi\u011fini pasif olarak dinleyerek potansiyel k\u00f6t\u00fc ama\u00e7l\u0131 etkinlikleri veya g\u00fcvenlik politikas\u0131 ihlallerini tespit etmeye odaklan\u0131r. Bir IPS, a\u011f trafi\u011fini aktif olarak denetleyerek potansiyel k\u00f6t\u00fc ama\u00e7l\u0131 etkinlikleri tespit eder ve bunlar\u0131 ger\u00e7ek zamanl\u0131 olarak engeller. Suricata’y\u0131 bir IPS olarak yap\u0131land\u0131rmak, a\u011f\u0131n\u0131z i\u00e7in proaktif bir g\u00fcvenlik katman\u0131 eklemek anlam\u0131na gelir. Bu, \u00f6zellikle kritik sunucular\u0131 veya hassas a\u011f segmentlerini korumak istedi\u011finizde tercih edilen bir yakla\u015f\u0131md\u0131r.<\/p>\n Suricata’y\u0131 Debian 11 \u00fczerinde bir IPS olarak yap\u0131land\u0131rmadan \u00f6nce, belirli \u00f6n ko\u015fullar\u0131 kar\u015f\u0131laman\u0131z ve sisteminizin belirli gereksinimleri kar\u015f\u0131lad\u0131\u011f\u0131ndan emin olman\u0131z gerekir.<\/p>\n * \u0130\u015flemci (CPU):<\/strong> Suricata, \u00e7ok i\u015f par\u00e7ac\u0131kl\u0131 yap\u0131s\u0131 sayesinde birden fazla \u00e7ekirdekten faydalan\u0131r. A\u011f trafi\u011finizin yo\u011funlu\u011funa ba\u011fl\u0131 olarak en az 2-4 CPU \u00e7ekirde\u011fi \u00f6nerilir. Daha y\u00fcksek trafik hacimleri i\u00e7in daha fazla \u00e7ekirdek veya daha y\u00fcksek saat h\u0131z\u0131na sahip i\u015flemciler gerekebilir. * Debian 11 (Bullseye):<\/strong> G\u00fcncel ve kararl\u0131 bir Debian 11 kurulumu. Bu \u00f6n ko\u015fullar\u0131 sa\u011flad\u0131ktan sonra, Suricata’n\u0131n kurulumuna ve IPS olarak yap\u0131land\u0131rmas\u0131na ge\u00e7ebiliriz.<\/p>\n Suricata’y\u0131 Debian 11 \u00fczerine kurman\u0131n birka\u00e7 yolu vard\u0131r. En g\u00fcncel s\u00fcr\u00fcm\u00fc ve t\u00fcm IPS \u00f6zelliklerini kullanmak i\u00e7in genellikle kaynaktan derleme y\u00f6ntemi tercih edilir.<\/p>\n Herhangi bir kuruluma ba\u015flamadan \u00f6nce sisteminizin g\u00fcncel oldu\u011fundan emin olun:<\/p>\n Suricata’y\u0131 kaynaktan derlemek i\u00e7in bir\u00e7ok geli\u015ftirme paketine ve k\u00fct\u00fcphaneye ihtiyac\u0131n\u0131z olacakt\u0131r.<\/p>\n En g\u00fcncel kararl\u0131 s\u00fcr\u00fcm\u00fc Suricata’n\u0131n resmi web sitesinden veya GitHub deposundan indirebilirsiniz.<\/p>\n \u015eimdi Suricata’y\u0131 Kurulum tamamland\u0131ktan sonra, dinamik ba\u011flant\u0131 \u00f6nbelle\u011fini g\u00fcncelleyin:<\/p>\n Kurulum, \u00f6rnek yap\u0131land\u0131rma dosyas\u0131n\u0131 Suricata’n\u0131n log dosyalar\u0131n\u0131 yazaca\u011f\u0131 dizini olu\u015fturun ve gerekli izinleri verin:<\/p>\n Suricata i\u00e7in bir kullan\u0131c\u0131 ve grup olu\u015fturun (e\u011fer otomatik olarak olu\u015fturulmad\u0131ysa):<\/p>\n Bu kullan\u0131c\u0131y\u0131 Bu komut, varsay\u0131lan olarak A\u015fa\u011f\u0131daki b\u00f6l\u00fcm\u00fc bulun ve Ayr\u0131ca, Kaydedip \u00e7\u0131k\u0131n (Ctrl+O, Enter, Ctrl+X).<\/p>\n Suricata’y\u0131 bir systemd servisi olarak y\u00f6netmek i\u00e7in bir servis dosyas\u0131 olu\u015ftural\u0131m:<\/p>\n \u0130\u00e7ine a\u015fa\u011f\u0131daki i\u00e7eri\u011fi yap\u0131\u015ft\u0131r\u0131n:<\/p>\n Kaydedip \u00e7\u0131k\u0131n. Ard\u0131ndan systemd’yi yeniden y\u00fckleyin ve Suricata servisini etkinle\u015ftirin:<\/p>\n Suricata’y\u0131 IPS olarak \u00e7al\u0131\u015ft\u0131rmak i\u00e7in iki ana y\u00f6ntem vard\u0131r: NFQUEUE kullanarak tek a\u011f kart\u0131 \u00fczerinde veya Inline (K\u00f6pr\u00fc Modu) kullanarak iki a\u011f kart\u0131 \u00fczerinde.<\/p>\n Bu y\u00f6ntem, IPS olarak \u00e7al\u0131\u015facak sistemin paketleri y\u00f6nlendirebilmesi gerekir:<\/p>\n Bu ayarlar\u0131n kal\u0131c\u0131 olmas\u0131 i\u00e7in A\u015fa\u011f\u0131daki sat\u0131rlar\u0131 ekleyin veya mevcutsa yorum i\u015faretini kald\u0131r\u0131n:<\/p>\n Kaydedip \u00e7\u0131k\u0131n ve de\u011fi\u015fiklikleri uygulay\u0131n:<\/p>\n T\u00fcm gelen ve giden trafi\u011fi Suricata’n\u0131n i\u015fleyece\u011fi Bu kurallar, t\u00fcm trafi\u011fi Suricata’ya g\u00f6nderecektir. E\u011fer Suricata \u00e7al\u0131\u015fm\u0131yorsa veya paketleri do\u011fru \u015fekilde i\u015flemezse, a\u011f ba\u011flant\u0131n\u0131z kesilecektir. Bu nedenle, bu kurallar\u0131 kal\u0131c\u0131 hale getirmeden \u00f6nce Suricata’n\u0131n do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olun.<\/p>\n Bu y\u00f6ntem, Suricata’y\u0131 iki a\u011f kart\u0131 aras\u0131na bir “k\u00f6pr\u00fc” olarak yerle\u015ftirir. Trafik, bir a\u011f kart\u0131ndan girer, Suricata taraf\u0131ndan i\u015flenir ve di\u011fer a\u011f kart\u0131ndan \u00e7\u0131kar. Bu, genellikle daha y\u00fcksek performans ve daha az gecikme sunar.<\/p>\n Varsay\u0131lan olarak, iki a\u011f kart\u0131n\u0131z\u0131n \u00d6ncelikle Ard\u0131ndan Mevcut i\u00e7eri\u011fi yedekledikten sonra, a\u015fa\u011f\u0131daki gibi yap\u0131land\u0131r\u0131n (IP adreslerini ve a\u011f ge\u00e7idini kendi a\u011f\u0131n\u0131za g\u00f6re ayarlay\u0131n):<\/p>\n Bu yap\u0131land\u0131rmada, De\u011fi\u015fiklikleri kaydettikten sonra a\u011f\u0131 yeniden ba\u015flat\u0131n veya sistemi yeniden ba\u015flat\u0131n:<\/p>\n E\u011fer Suricata’n\u0131n kendisinin bir k\u00f6pr\u00fc gibi davranmas\u0131n\u0131 istiyorsan\u0131z, Bu yap\u0131land\u0131rma, \u00d6nemli:<\/strong> Suricata’n\u0131n etkin bir IPS olabilmesi i\u00e7in g\u00fcncel ve kapsaml\u0131 kural setlerine sahip olmas\u0131 gerekir. Varsay\u0131lan olarak * Yeni Bir Kaynak Etkinle\u015ftirme (\u00d6rnek: Proofpoint ET Pro – \u00fccretli abonelik gerektirir):<\/strong><\/p>\n E\u011fer bir ET Pro abonesiyseniz, abonelik kodunuzu Bu komut, yap\u0131land\u0131r\u0131lm\u0131\u015f t\u00fcm kaynaklardan en son kurallar\u0131 indirir ve Kurallar\u0131n d\u00fczenli olarak g\u00fcncellenmesi i\u00e7in bir A\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin (\u00f6rne\u011fin, her gece saat 3’te g\u00fcncelleme yapar ve Suricata servisini yeniden ba\u015flat\u0131r):<\/p>\n Bu, Suricata’n\u0131n her zaman en g\u00fcncel tehdit istihbarat\u0131yla \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar.<\/p>\n Yap\u0131land\u0131rma tamamland\u0131ktan sonra Suricata’y\u0131 ba\u015flatabilir ve IPS modunun d\u00fczg\u00fcn \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 test edebilirsiniz.<\/p>\n Suricata’y\u0131 ba\u015flatmadan \u00f6nce yap\u0131land\u0131rma dosyan\u0131z\u0131n s\u00f6zdizimsel olarak do\u011fru oldu\u011fundan emin olun:<\/p>\n E\u011fer bir hata varsa, Suricata size hangi sat\u0131rda oldu\u011funu s\u00f6yleyecektir. Hata yoksa “Configuration provided was successfully loaded” mesaj\u0131n\u0131 g\u00f6r\u00fcrs\u00fcn\u00fcz.<\/p>\n Durum IPS modunun \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulamak i\u00e7in \u00e7e\u015fitli testler yapabilirsiniz.<\/p>\n EICAR (European Institute for Computer Antivirus Research) testi, antivir\u00fcs yaz\u0131l\u0131mlar\u0131n\u0131 test etmek i\u00e7in kullan\u0131lan zarars\u0131z bir test dosyas\u0131d\u0131r. Suricata’da genellikle EICAR imzalar\u0131n\u0131 i\u00e7eren kurallar bulunur. Suricata’n\u0131n g\u00fcnl\u00fck dosyalar\u0131n\u0131 kontrol edin:<\/p>\n EICAR testi s\u0131ras\u0131nda \u00d6zel bir test kural\u0131 olu\u015fturarak IPS i\u015flevselli\u011fini daha net g\u00f6rebilirsiniz. \u0130\u00e7ine a\u015fa\u011f\u0131daki kural\u0131 ekleyin (\u00f6rne\u011fin, belirli bir IP’den gelen t\u00fcm ICMP trafi\u011fini engeller):<\/p>\n Bu kural\u0131 aktif hale getirmek i\u00e7in Suricata servisini yeniden ba\u015flat\u0131n:<\/p>\n Ard\u0131ndan, kuralda belirtti\u011finiz IP adresinden Suricata’n\u0131n korudu\u011fu bir makineye IPS modunda \u00e7al\u0131\u015fan Suricata, a\u011f trafi\u011fini do\u011frudan i\u015fledi\u011fi i\u00e7in performans kritik \u00f6neme sahiptir. Yetersiz yap\u0131land\u0131rma, a\u011f gecikmesine veya paket kayb\u0131na neden olabilir.<\/p>\n * CPU ve Bellek Kullan\u0131m\u0131:<\/strong>
\n* IDS\/IPS Yetenekleri:<\/strong> A\u011f trafi\u011fini analiz ederek k\u00f6t\u00fc ama\u00e7l\u0131 etkinlikleri tespit edebilir (IDS) ve bu etkinlikleri aktif olarak engelleyebilir (IPS).
\n* NSM (Network Security Monitoring) Yetenekleri:<\/strong> A\u011f trafi\u011fi, DNS sorgular\u0131, HTTP istekleri, TLS el s\u0131k\u0131\u015fmalar\u0131 ve dosya aktar\u0131mlar\u0131 gibi \u00e7e\u015fitli a\u011f olaylar\u0131n\u0131 detayl\u0131 bir \u015fekilde g\u00fcnl\u00fc\u011fe kaydederek kapsaml\u0131 a\u011f g\u00fcvenlik izlemesi sa\u011flar.
\n* Esnek Kural Motoru:<\/strong> Snort kurallar\u0131yla uyumludur ve ayn\u0131 zamanda kendi geli\u015fmi\u015f kural diliyle daha karma\u015f\u0131k desen e\u015fle\u015ftirmeleri ve protokol analizleri yapabilir.
\n* Protokol Ayr\u0131\u015ft\u0131rma:<\/strong> HTTP, TLS, FTP, SMB, DNS gibi bir\u00e7ok uygulama katman\u0131 protokol\u00fcn\u00fc derinlemesine analiz edebilir.
\n* Dosya \u00c7\u0131karma:<\/strong> A\u011f \u00fczerinden aktar\u0131lan dosyalar\u0131 alg\u0131layabilir ve depolayabilir, bu da k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m analizi i\u00e7in faydal\u0131d\u0131r.
\n* Donan\u0131m H\u0131zland\u0131rma Deste\u011fi:<\/strong> DPDK (Data Plane Development Kit) ve PF_RING gibi teknolojilerle entegre olarak y\u00fcksek paket i\u015fleme h\u0131zlar\u0131na ula\u015fabilir.
\n* \u00c7e\u015fitli \u00c7\u0131kt\u0131 Formatlar\u0131:<\/strong> Eve JSON, unified2, pcap ve alert.log gibi \u00e7e\u015fitli formatlarda g\u00fcnl\u00fck ve uyar\u0131 \u00e7\u0131kt\u0131lar\u0131 \u00fcretebilir, bu da SIEM (Security Information and Event Management) sistemleriyle entegrasyonu kolayla\u015ft\u0131r\u0131r.<\/p>\nIDS ve IPS Aras\u0131ndaki Fark Nedir?<\/h3>\n
Intrusion Detection System (IDS)<\/h4>\n
\n* Pasif \u0130zleme:<\/strong> IDS, a\u011f trafi\u011fini kopyalayarak (\u00f6rne\u011fin, SPAN\/Mirror portlar\u0131 veya a\u011f TAP’leri arac\u0131l\u0131\u011f\u0131yla) analiz eder ve orijinal trafik ak\u0131\u015f\u0131n\u0131 etkilemez.
\n* Uyar\u0131 Verme:<\/strong> Bir tehdit alg\u0131lad\u0131\u011f\u0131nda, IDS bir uyar\u0131 (alert) olu\u015fturur ve bunu g\u00fcvenlik y\u00f6neticisine veya bir SIEM sistemine g\u00f6nderir.
\n* M\u00fcdahale Yok:<\/strong> IDS, tehdidi engelleme veya durdurma yetene\u011fine sahip de\u011fildir. Sadece durumu bildirir.
\n* Avantajlar\u0131:<\/strong> A\u011f performans\u0131n\u0131 etkilemez, yanl\u0131\u015f pozitiflerin (false positives) kritik i\u015f s\u00fcre\u00e7lerini kesintiye u\u011fratma riski yoktur.
\n* Dezavantajlar\u0131:<\/strong> Tehditler ger\u00e7ek zamanl\u0131 olarak engellenemez, manuel m\u00fcdahale gerektirir, sald\u0131r\u0131 ger\u00e7ekle\u015ftikten sonra bilgi sa\u011flar.<\/p>\nIntrusion Prevention System (IPS)<\/h4>\n
\n* Aktif M\u00fcdahale:<\/strong> IPS, a\u011f trafi\u011fini “inline” (sat\u0131r i\u00e7i) modda, yani trafi\u011fin ak\u0131\u015f yolu \u00fczerinde konumland\u0131r\u0131l\u0131r. T\u00fcm trafik IPS \u00fczerinden ge\u00e7er.
\n* Engelleme Yetene\u011fi:<\/strong> Bir tehdit alg\u0131lad\u0131\u011f\u0131nda, IPS paketi d\u00fc\u015f\u00fcrebilir, ba\u011flant\u0131y\u0131 s\u0131f\u0131rlayabilir veya trafi\u011fi ba\u015fka bir yere y\u00f6nlendirebilir.
\n* Avantajlar\u0131:<\/strong> Ger\u00e7ek zamanl\u0131 koruma sa\u011flar, sald\u0131r\u0131lar\u0131 daha etkili bir \u015fekilde \u00f6nler, manuel m\u00fcdahale ihtiyac\u0131n\u0131 azalt\u0131r.
\n* Dezavantajlar\u0131:<\/strong> A\u011f performans\u0131n\u0131 etkileyebilir (gecikme ekleyebilir), yanl\u0131\u015f pozitifler kritik i\u015f s\u00fcre\u00e7lerini kesintiye u\u011fratabilir (\u00f6rne\u011fin, me\u015fru trafi\u011fi engelleyebilir), do\u011fru yap\u0131land\u0131rma ve izleme gerektirir.<\/p>\n\u00d6n Ko\u015fullar ve Sistem Gereksinimleri<\/h3>\n
Donan\u0131m Gereksinimleri<\/h4>\n
\n* Bellek (RAM):<\/strong> Kural setinin b\u00fcy\u00fckl\u00fc\u011f\u00fc ve i\u015flenen trafik miktar\u0131 RAM t\u00fcketimini etkiler. Minimum 4 GB RAM \u00f6nerilir, ancak 8 GB veya daha fazlas\u0131 daha iyi performans ve kararl\u0131l\u0131k sa\u011flayacakt\u0131r. \u00d6zellikle b\u00fcy\u00fck kural setleri kullan\u0131l\u0131yorsa daha fazla RAM kritik \u00f6neme sahiptir.
\n* Depolama (Disk):<\/strong> \u0130\u015fletim sistemi, Suricata yaz\u0131l\u0131m\u0131, kural setleri ve g\u00fcnl\u00fck dosyalar\u0131 i\u00e7in yeterli depolama alan\u0131 gereklidir. Minimum 20 GB disk alan\u0131 \u00f6nerilir. G\u00fcnl\u00fck dosyalar\u0131n\u0131n h\u0131zla b\u00fcy\u00fcyebilece\u011fini unutmay\u0131n, bu nedenle ayr\u0131 bir disk b\u00f6l\u00fcm\u00fc veya daha b\u00fcy\u00fck bir disk alan\u0131 d\u00fc\u015f\u00fcnmek ak\u0131ll\u0131ca olabilir. H\u0131zl\u0131 diskler (SSD), \u00f6zellikle g\u00fcnl\u00fck yazma i\u015flemleri i\u00e7in performans\u0131 art\u0131r\u0131r.
\n* A\u011f Kartlar\u0131 (NICs):<\/strong> IPS modunda Suricata, a\u011f trafi\u011fi ak\u0131\u015f\u0131n\u0131n i\u00e7inde yer al\u0131r.
\n * Tek A\u011f Kart\u0131 (NFQUEUE Modu \u0130\u00e7in):<\/strong> E\u011fer Suricata’y\u0131 ayn\u0131 a\u011f kart\u0131 \u00fczerinde iptables<\/code> ve NFQUEUE<\/code> kullanarak bir IPS olarak yap\u0131land\u0131racaksan\u0131z, tek bir fiziksel a\u011f kart\u0131 yeterli olabilir. Ancak bu, trafi\u011fin i\u015fletim sistemi \u00e7ekirde\u011fi \u00fczerinden ge\u00e7i\u015fi nedeniyle ek gecikmeye neden olabilir.
\n * \u0130ki A\u011f Kart\u0131 (Inline\/K\u00f6pr\u00fc Modu \u0130\u00e7in):<\/strong> En yayg\u0131n ve performansl\u0131 IPS yap\u0131land\u0131rmas\u0131, iki a\u011f kart\u0131 kullanmakt\u0131r. Bu kartlardan biri “WAN” (veya “d\u0131\u015f”) taraf\u0131na, di\u011feri “LAN” (veya “i\u00e7”) taraf\u0131na bakacak \u015fekilde yap\u0131land\u0131r\u0131l\u0131r ve Suricata bu iki kart aras\u0131nda bir k\u00f6pr\u00fc g\u00f6revi g\u00f6r\u00fcr. Bu mod, a\u011f trafi\u011fini daha do\u011frudan i\u015fler.<\/p>\nYaz\u0131l\u0131m \u00d6n Ko\u015fullar\u0131<\/h4>\n
\n* Root veya Sudo Yetkileri:<\/strong> Kurulum ve yap\u0131land\u0131rma i\u015flemleri i\u00e7in root kullan\u0131c\u0131s\u0131 veya sudo<\/code> yetkilerine sahip bir kullan\u0131c\u0131 hesab\u0131 gereklidir.
\n* \u0130nternet Ba\u011flant\u0131s\u0131:<\/strong> Gerekli paketleri indirmek ve Suricata kural setlerini g\u00fcncellemek i\u00e7in aktif bir internet ba\u011flant\u0131s\u0131.
\n* Temel Linux Bilgisi:<\/strong> Komut sat\u0131r\u0131 kullan\u0131m\u0131, dosya sistemi navigasyonu ve metin d\u00fczenleyiciler (nano, vim) hakk\u0131nda temel bilgi.<\/p>\nKurulum Ad\u0131mlar\u0131<\/h3>\n
1. Sistemi G\u00fcncelleme<\/h4>\n
sudo apt update\nsudo apt upgrade -y\nsudo apt dist-upgrade -y\nsudo reboot # Gerekirse sistemi yeniden ba\u015flat\u0131n<\/code><\/pre>\n2. Gerekli Ba\u011f\u0131ml\u0131l\u0131klar\u0131 Kurma<\/h4>\n
sudo apt install -y build-essential autoconf automake libtool pkg-config \\\n libcap-ng-dev libnetfilter-queue-dev libyaml-dev \\\n libpcre2-dev libhiredis-dev libluajit-5.1-dev \\\n libnfnetlink-dev libnss3-dev liblz4-dev libhtp-dev \\\n libjansson-dev rustc cargo python3-pip \\\n libmagic-dev libgeoip-dev libmaxminddb-dev \\\n libevent-dev libsndfile-dev libunwind-dev \\\n liblzma-dev libzstd-dev libbpf-dev<\/code><\/pre>\npython3-pip<\/code> ile suricata-update<\/code> i\u00e7in gerekli olan pyyaml<\/code> ve requests<\/code> gibi Python k\u00fct\u00fcphanelerini kuraca\u011f\u0131z:<\/p>\nsudo pip3 install pyyaml requests<\/code><\/pre>\n3. Suricata Kaynak Kodunu \u0130ndirme<\/h4>\n
cd \/opt\nsudo wget https:\/\/www.openinfosecfoundation.org\/download\/suricata-6.0.10.tar.gz # En g\u00fcncel s\u00fcr\u00fcm\u00fc kontrol edin\nsudo tar -xvzf suricata-6.0.10.tar.gz\ncd suricata-6.0.10<\/code><\/pre>\n4. Suricata’y\u0131 Derleme ve Kurma<\/h4>\n
NFQUEUE<\/code> deste\u011fi ile derleyece\u011fiz. NFQUEUE<\/code>, iptables<\/code> ile entegre olarak IPS modunu etkinle\u015ftirmek i\u00e7in kullan\u0131l\u0131r.<\/p>\nsudo .\/configure --prefix=\/usr --sysconfdir=\/etc --localstatedir=\/var \\\n --enable-nfqueue --enable-lua --enable-geoip \\\n --enable-rust --enable-tls-shared --enable-tcp-stream \\\n --enable-ipfw --enable-app-layer-log \\\n --with-libhtp-includes=\/usr\/include\/libhtp \\\n --with-libhtp-libraries=\/usr\/lib\/x86_64-linux-gnu\nsudo make\nsudo make install<\/code><\/pre>\nsudo ldconfig<\/code><\/pre>\n5. Suricata Yap\u0131land\u0131rma Dosyalar\u0131n\u0131 ve Kural Setlerini Haz\u0131rlama<\/h4>\n
\/etc\/suricata<\/code> dizinine kopyalamaz. Bunu manuel olarak yapmal\u0131y\u0131z:<\/p>\nsudo mkdir -p \/etc\/suricata\nsudo cp suricata.yaml \/etc\/suricata\/\nsudo cp classification.config \/etc\/suricata\/\nsudo cp reference.config \/etc\/suricata\/<\/code><\/pre>\nsudo mkdir -p \/var\/log\/suricata\nsudo chown -R suricata:suricata \/var\/log\/suricata # Suricata kullan\u0131c\u0131s\u0131 ve grubu yoksa olu\u015fturun.<\/code><\/pre>\nsudo groupadd suricata\nsudo useradd -r -g suricata -s \/sbin\/nologin -c \"Suricata User\" suricata<\/code><\/pre>\nadm<\/code> grubuna eklemek, baz\u0131 sistem g\u00fcnl\u00fcklerine eri\u015fmesini sa\u011flayabilir:<\/p>\nsudo usermod -a -G adm suricata<\/code><\/pre>\n6.
suricata-update<\/code> Kurulumu ve Kural Setlerini \u0130ndirme<\/h4>\nsuricata-update<\/code> arac\u0131, Suricata kural setlerini y\u00f6netmek ve g\u00fcncellemek i\u00e7in kullan\u0131l\u0131r.<\/p>\nsudo \/usr\/bin\/suricata-update # Bu komut, PATH'e eklenmedi\u011fi i\u00e7in tam yolu kullan\u0131n.<\/code><\/pre>\nET Open<\/code> kural setini indirir ve \/etc\/suricata\/rules<\/code> dizinine yerle\u015ftirir. \u0130lk \u00e7al\u0131\u015ft\u0131rmada biraz zaman alabilir.
\nKural setlerini indirdikten sonra, suricata.yaml<\/code> dosyas\u0131nda bu kurallar\u0131 kullanmak \u00fczere yap\u0131land\u0131rmam\u0131z gerekir. \/etc\/suricata\/suricata.yaml<\/code> dosyas\u0131n\u0131 bir metin d\u00fczenleyici ile a\u00e7\u0131n:<\/p>\nsudo nano \/etc\/suricata\/suricata.yaml<\/code><\/pre>\nsuricata.rules<\/code> sat\u0131r\u0131n\u0131n etkin oldu\u011fundan emin olun (ba\u015f\u0131ndaki #<\/code> i\u015faretini kald\u0131r\u0131n):<\/p>\n# Rule files\nrule-files:\n - suricata.rules<\/code><\/pre>\ndefault-log-dir<\/code> ayar\u0131n\u0131n do\u011fru oldu\u011fundan emin olun:<\/p>\ndefault-log-dir: \/var\/log\/suricata<\/code><\/pre>\n7. Systemd Servisi Olu\u015fturma<\/h4>\n
sudo nano \/etc\/systemd\/system\/suricata.service<\/code><\/pre>\n[Unit]\nDescription=Suricata Intrusion Detection and Prevention System\nAfter=network.target\n\n[Service]\nType=forking\nPIDFile=\/var\/run\/suricata.pid\nExecStartPre=\/usr\/bin\/suricata -c \/etc\/suricata\/suricata.yaml --pidfile \/var\/run\/suricata.pid -D --check-conf\nExecStart=\/usr\/bin\/suricata -c \/etc\/suricata\/suricata.yaml --pidfile \/var\/run\/suricata.pid -D -q 0 # -q 0 NFQUEUE 0'\u0131 dinle\nExecReload=\/bin\/kill -HUP $MAINPID\nExecStop=\/bin\/kill $MAINPID\nPrivateTmp=true\nRestart=on-failure\n\n[Install]\nWantedBy=multi-user.target<\/code><\/pre>\nsudo systemctl daemon-reload\nsudo systemctl enable suricata<\/code><\/pre>\nIPS Modu \u0130\u00e7in A\u011f Yap\u0131land\u0131rmas\u0131<\/h3>\n
1. NFQUEUE Kullanarak IPS (Tek A\u011f Kart\u0131)<\/h4>\n
iptables<\/code> g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131 kullanarak a\u011f trafi\u011fini Suricata’ya y\u00f6nlendirir ve Suricata’n\u0131n i\u015fledi\u011fi trafi\u011fi geri al\u0131r. Bu, genellikle tek bir a\u011f aray\u00fcz\u00fcne sahip makinelerde kullan\u0131l\u0131r ve sanal makineler i\u00e7in ideal olabilir.<\/p>\n1.1 IP Y\u00f6nlendirmeyi Etkinle\u015ftirme<\/h5>\n
sudo sysctl -w net.ipv4.ip_forward=1\nsudo sysctl -w net.ipv6.conf.all.forwarding=1<\/code><\/pre>\n\/etc\/sysctl.conf<\/code> dosyas\u0131na ekleyin:<\/p>\nsudo nano \/etc\/sysctl.conf<\/code><\/pre>\nnet.ipv4.ip_forward=1\nnet.ipv6.conf.all.forwarding=1<\/code><\/pre>\nsudo sysctl -p<\/code><\/pre>\n1.2
iptables<\/code> Kurallar\u0131n\u0131 Yap\u0131land\u0131rma<\/h5>\nNFQUEUE<\/code> kuyru\u011funa y\u00f6nlendirmek i\u00e7in iptables<\/code> kurallar\u0131 eklemeniz gerekir. Suricata’y\u0131 ba\u015flat\u0131rken -q 0<\/code> parametresi ile 0 numaral\u0131 kuyru\u011fu dinlemesini sa\u011flad\u0131k.<\/p>\n# Mevcut iptables kurallar\u0131n\u0131 temizle (dikkatli olun, bu a\u011f ba\u011flant\u0131n\u0131z\u0131 kesintiye u\u011fratabilir!)\nsudo iptables -F\nsudo iptables -X\nsudo iptables -Z\nsudo iptables -P INPUT ACCEPT\nsudo iptables -P FORWARD ACCEPT\nsudo iptables -P OUTPUT ACCEPT\n\nT\u00fcm gelen, giden ve y\u00f6nlendirilen IPv4 trafi\u011fini NFQUEUE'ye y\u00f6nlendir<\/h2>\nsudo iptables -I INPUT -j NFQUEUE --queue-num 0\nsudo iptables -I FORWARD -j NFQUEUE --queue-num 0\nsudo iptables -I OUTPUT -j NFQUEUE --queue-num 0\n\n
IPv6 i\u00e7in de benzer kurallar<\/h2>\nsudo ip6tables -F\nsudo ip6tables -X\nsudo sudo ip6tables -Z\nsudo ip6tables -P INPUT ACCEPT\nsudo ip6tables -P FORWARD ACCEPT\nsudo ip6tables -P OUTPUT ACCEPT\nsudo ip6tables -I INPUT -j NFQUEUE --queue-num 0\nsudo ip6tables -I FORWARD -j NFQUEUE --queue-num 0\nsudo ip6tables -I OUTPUT -j NFQUEUE --queue-num 0<\/code><\/pre>\n
1.3
suricata.yaml<\/code> \u0130\u00e7inde NFQUEUE Ayarlar\u0131<\/h5>\nsuricata.yaml<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n:<\/p>\nsudo nano \/etc\/suricata\/suricata.yaml<\/code><\/pre>\nnfqueue<\/code> b\u00f6l\u00fcm\u00fcn\u00fc bulun ve a\u015fa\u011f\u0131daki gibi yap\u0131land\u0131r\u0131n:<\/p>\nnfqueue:\n mode: autofp\n queue-num: 0\n queue-size: 4096\n # If you want to run multiple instances of Suricata, each instance must\n # listen on a unique queue-id range. For example:\n # instance 1: queue-id: 0\n # instance 2: queue-id: 1\n # instance 3: queue-id: 2\n # For a single instance, queue-id: 0 is sufficient.<\/code><\/pre>\nqueue-num: 0<\/code> ayar\u0131, Suricata’n\u0131n iptables<\/code> kurallar\u0131nda belirtti\u011fimiz 0 numaral\u0131 kuyru\u011fu dinlemesini sa\u011flar.<\/p>\n2. Inline (K\u00f6pr\u00fc Modu) Kullanarak IPS (\u0130ki A\u011f Kart\u0131)<\/h4>\n
2.1 A\u011f Kartlar\u0131n\u0131 K\u00f6pr\u00fc Moduna Getirme<\/h5>\n
eth0<\/code> ve eth1<\/code> (veya benzeri isimler) oldu\u011funu varsayal\u0131m. Bu kartlar\u0131 bir k\u00f6pr\u00fcye (br0<\/code>) eklememiz gerekiyor.<\/p>\nbridge-utils<\/code> paketini kurun:<\/p>\nsudo apt install -y bridge-utils<\/code><\/pre>\n\/etc\/network\/interfaces<\/code> dosyas\u0131n\u0131 d\u00fczenleyin:<\/p>\nsudo nano \/etc\/network\/interfaces<\/code><\/pre>\n# \/etc\/network\/interfaces\nBu dosya, sistemin a\u011f aray\u00fczlerini yap\u0131land\u0131r\u0131r.<\/h2>\n
Daha fazla bilgi i\u00e7in interfaces(5) man sayfas\u0131na bak\u0131n.<\/h2>\n\n
Loopback aray\u00fcz\u00fc<\/h2>\nauto lo\niface lo inet loopback\n\n
Mevcut aray\u00fczleri devre d\u0131\u015f\u0131 b\u0131rak<\/h2>\n
(eth0 ve eth1'in IP almas\u0131n\u0131 engeller)<\/h2>\n
E\u011fer bu aray\u00fczler DHCP ile IP al\u0131yorsa,<\/h2>\n
a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 ekleyerek DHCP'yi kapat\u0131n<\/h2>\n
auto eth0<\/h2>\n
iface eth0 inet manual<\/h2>\n
auto eth1<\/h2>\n
iface eth1 inet manual<\/h2>\n\n
K\u00f6pr\u00fc aray\u00fcz\u00fc<\/h2>\nauto br0\niface br0 inet static\n address 192.168.1.100 # Suricata IPS'in kendi y\u00f6netim IP'si\n netmask 255.255.255.0\n gateway 192.168.1.1\n dns-nameservers 8.8.8.8 8.8.4.4\n bridge_ports eth0 eth1 # K\u00f6pr\u00fcye eklenecek fiziksel a\u011f kartlar\u0131\n bridge_fd 0 # Forwarding gecikmesi (0 = hemen ilet)\n bridge_stp off # Spanning Tree Protocol'\u00fc kapat\n bridge_waitmax 0 # K\u00f6pr\u00fcn\u00fcn haz\u0131r olmas\u0131n\u0131 bekleme s\u00fcresi (0 = bekleme)<\/code><\/pre>\n
eth0<\/code> ve eth1<\/code> fiziksel aray\u00fczleri k\u00f6pr\u00fcye eklenir ve br0<\/code> aray\u00fcz\u00fc \u00fczerinden IP adresi al\u0131r. Suricata, bu br0<\/code> aray\u00fcz\u00fc \u00fczerinden veya do\u011frudan eth0<\/code> ve eth1<\/code> \u00fczerinden trafi\u011fi izleyebilir. En iyi uygulama, Suricata’n\u0131n do\u011frudan fiziksel aray\u00fczleri af-packet<\/code> modunda kullanmas\u0131d\u0131r.<\/p>\nsudo systemctl restart networking\nsudo reboot # Genellikle yeniden ba\u015flatma \u00f6nerilir<\/code><\/pre>\n2.2
suricata.yaml<\/code> \u0130\u00e7inde AF_PACKET Ayarlar\u0131<\/h5>\nsuricata.yaml<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n:<\/p>\nsudo nano \/etc\/suricata\/suricata.yaml<\/code><\/pre>\naf-packet<\/code> b\u00f6l\u00fcm\u00fcn\u00fc bulun ve a\u015fa\u011f\u0131daki gibi yap\u0131land\u0131r\u0131n. eth0<\/code> ve eth1<\/code> yerine kendi a\u011f kart\u0131 isimlerinizi yaz\u0131n.<\/p>\naf-packet:\n - interface: eth0 # D\u0131\u015fa bakan aray\u00fcz (WAN)\n # If copy-mode is set to 'tap', Suricata will only log alerts.\n # If copy-mode is set to 'ips', Suricata will actively drop\/reject packets.\n copy-mode: ips\n # If the interface is part of a bridge, set this to yes.\n # If not part of a bridge, set to no.\n # In this inline setup, it's generally 'no' as Suricata handles bridging.\n # Ancak, Suricata'n\u0131n k\u00f6pr\u00fc modunda \u00e7al\u0131\u015fmas\u0131 i\u00e7in iki aray\u00fcz\u00fc de belirtmek gerekir.\n # Suricata 6.x ve sonras\u0131 i\u00e7in, tek bir af-packet blo\u011fu alt\u0131nda\n # birden fazla aray\u00fcz\u00fc \"cluster-id\" ile gruplamak daha yayg\u0131nd\u0131r.\n # A\u015fa\u011f\u0131daki \u00f6rnekte, her aray\u00fcz i\u00e7in ayr\u0131 bir blok kullan\u0131yoruz.\n\n - interface: eth1 # \u0130\u00e7e bakan aray\u00fcz (LAN)\n copy-mode: ips\n # cluster-id ve cluster-type, birden fazla aray\u00fcz\u00fc ayn\u0131 IPS mant\u0131\u011f\u0131na ba\u011flamak i\u00e7in kullan\u0131l\u0131r.\n # \u00d6rne\u011fin:\n # cluster-id: 99\n # cluster-type: cluster_flow<\/code><\/pre>\nsuricata.yaml<\/code> i\u00e7inde af-packet<\/code> modunda tpacket-v3<\/code> ve cluster-type: cluster_flow<\/code> kullanman\u0131z \u00f6nerilir.<\/p>\naf-packet:\n - interface: eth0\n threads: 1\n defrag: yes\n cluster-id: 99\n cluster-type: cluster_flow\n copy-mode: ips\n # BPF filtreleri burada uygulanabilir\n # BPF: !ip6 and not (vlan) # IPv6 ve VLAN trafi\u011fini hari\u00e7 tut\n\n - interface: eth1\n threads: 1\n defrag: yes\n cluster-id: 99\n cluster-type: cluster_flow\n copy-mode: ips<\/code><\/pre>\neth0<\/code> ve eth1<\/code> aray\u00fczlerini ayn\u0131 cluster-id<\/code> alt\u0131nda grupland\u0131rarak, Suricata’n\u0131n bu iki aray\u00fcz aras\u0131nda akan trafi\u011fi tek bir IPS mant\u0131\u011f\u0131yla i\u015flemesini sa\u011flar. copy-mode: ips<\/code> ise Suricata’n\u0131n engelleme modunda \u00e7al\u0131\u015faca\u011f\u0131n\u0131 belirtir.<\/p>\nhome-net<\/code> ve external-net<\/code> ayarlar\u0131n\u0131 kendi a\u011f\u0131n\u0131za g\u00f6re yap\u0131land\u0131r\u0131n. Bu, Suricata’n\u0131n hangi IP adreslerinin dahili (g\u00fcvenilen) ve harici (g\u00fcvenilmeyen) oldu\u011funu bilmesi i\u00e7in kritik \u00f6neme sahiptir.<\/p>\nvars:\n # Suricata'n\u0131n yerel a\u011f olarak kabul edece\u011fi IP adresleri\n home-net: \"[192.168.1.0\/24,10.0.0.0\/8,172.16.0.0\/12]\"\n # Suricata'n\u0131n harici a\u011f olarak kabul edece\u011fi IP adresleri\n external-net: \"any\" # veya \"[!$HOME_NET]\"<\/code><\/pre>\nKural Y\u00f6netimi ve G\u00fcncelleme<\/h3>\n
suricata-update<\/code> arac\u0131 bu s\u00fcreci basitle\u015ftirir.<\/p>\n1.
suricata-update<\/code> Kullan\u0131m\u0131<\/h4>\nET Open<\/code> (Emerging Threats Open) kural setini kullan\u0131r. Di\u011fer kural setlerini de etkinle\u015ftirebilirsiniz.
\n* Mevcut Kaynaklar\u0131 Listeleme:<\/strong><\/p>\nsudo suricata-update list-sources<\/code><\/pre>\nsudo suricata-update enable-source et\/pro<\/code><\/pre>\n\/etc\/suricata\/suricata-update.yaml<\/code> dosyas\u0131na eklemeniz gerekebilir.
\n* Kurallar\u0131 G\u00fcncelleme:<\/strong><\/p>\nsudo suricata-update<\/code><\/pre>\n\/etc\/suricata\/rules\/suricata.rules<\/code> dosyas\u0131n\u0131 olu\u015fturur.<\/p>\n2. Otomatik Kural G\u00fcncelleme<\/h4>\n
cron<\/code> i\u015fi ayarlayabilirsiniz.<\/p>\nsudo crontab -e<\/code><\/pre>\n0 3 <\/em> * \/usr\/bin\/suricata-update && systemctl restart suricata<\/code><\/pre>\nSuricata’y\u0131 \u00c7al\u0131\u015ft\u0131rma ve Test Etme<\/h3>\n
1. Yap\u0131land\u0131rma Dosyas\u0131n\u0131 Do\u011frulama<\/h4>\n
sudo suricata -T -c \/etc\/suricata\/suricata.yaml -i Veya NFQUEUE i\u00e7in:<\/h2>\nsudo suricata -T -c \/etc\/suricata\/suricata.yaml --nfqueue<\/code><\/pre>\n
2. Servis Olarak Ba\u015flatma<\/h4>\n
sudo systemctl start suricata\nsudo systemctl status suricata<\/code><\/pre>\nactive (running)<\/code> olmal\u0131 ve herhangi bir hata mesaj\u0131 olmamal\u0131d\u0131r.<\/p>\n3. Test Etme<\/h4>\n
3.1 EICAR Testi<\/h5>\n
\nIPS modunda, EICAR dosyas\u0131n\u0131 indirmeye \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131zda Suricata’n\u0131n ba\u011flant\u0131y\u0131 kesmesi veya paketi d\u00fc\u015f\u00fcrmesi beklenir.
\nBir istemci makineden (Suricata IPS’in korudu\u011fu a\u011fda), bir web taray\u0131c\u0131s\u0131 ile EICAR test dosyas\u0131na eri\u015fmeye \u00e7al\u0131\u015f\u0131n:
\nhttp:\/\/www.eicar.org\/download\/eicar.com<\/code>
\nE\u011fer Suricata do\u011fru \u00e7al\u0131\u015f\u0131yorsa, indirme i\u015flemi ba\u015far\u0131s\u0131z olmal\u0131 veya bir hata mesaj\u0131 almal\u0131s\u0131n\u0131z.<\/p>\n3.2 G\u00fcnl\u00fckleri Kontrol Etme<\/h5>\n
sudo tail -f \/var\/log\/suricata\/fast.log\nsudo tail -f \/var\/log\/suricata\/alert.log\nsudo tail -f \/var\/log\/suricata\/eve.json # JSON format\u0131ndaki olay g\u00fcnl\u00fckleri<\/code><\/pre>\nalert.log<\/code> veya eve.json<\/code> i\u00e7inde EICAR ile ilgili bir uyar\u0131 g\u00f6rmelisiniz. \u00d6rne\u011fin:
\n[] [1:2000000:2] EICAR Test File [<\/strong>] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 192.168.1.10:54321 -> 93.184.216.34:80<\/code>
\nE\u011fer NFQUEUE<\/code> kullan\u0131yorsan\u0131z, iptables<\/code> sayac\u0131n\u0131 kontrol edebilirsiniz:<\/p>\nsudo iptables -L -v -n<\/code><\/pre>\nNFQUEUE<\/code> zincirinde paket ve bayt say\u0131lar\u0131n\u0131n artt\u0131\u011f\u0131n\u0131 g\u00f6rmelisiniz, bu da trafi\u011fin Suricata taraf\u0131ndan i\u015flendi\u011fini g\u00f6sterir.<\/p>\n3.3 Basit Bir Bloklama Kural\u0131 Olu\u015fturma (Opsiyonel)<\/h5>\n
\n\/etc\/suricata\/rules\/local.rules<\/code> ad\u0131nda yeni bir dosya olu\u015fturun:<\/p>\nsudo nano \/etc\/suricata\/rules\/local.rules<\/code><\/pre>\ndrop icmp any any -> $HOME_NET any (msg:\"TEST: ICMP from specific IP blocked\"; sid:2000001; rev:1;)<\/code><\/pre>\nsuricata.yaml<\/code> dosyas\u0131n\u0131 d\u00fczenleyin ve rule-files<\/code> b\u00f6l\u00fcm\u00fcne local.rules<\/code> dosyas\u0131n\u0131 ekleyin:<\/p>\nrule-files:\n - suricata.rules\n - local.rules<\/code><\/pre>\nsudo systemctl restart suricata<\/code><\/pre>\nping<\/code> atmay\u0131 deneyin. ping<\/code> komutunun ba\u015far\u0131s\u0131z olmas\u0131 ve Suricata g\u00fcnl\u00fcklerinde bir uyar\u0131 g\u00f6rmeniz gerekir.<\/p>\nPerformans \u0130zleme ve Optimizasyon<\/h3>\n
1. Performans Metriklerini \u0130zleme<\/h4>\n
top<\/code>, htop<\/code>, glances<\/code> gibi ara\u00e7larla Suricata s\u00fcrecinin CPU ve RAM kullan\u0131m\u0131n\u0131 d\u00fczenli olarak izleyin.