/* Suricata thread model */

Receive threads (RX):
  Read packets from NIC (AF_PACKET, AF_XDP, DPDK, PCAP)
  Decode: Ethernet → IP → TCP/UDP → application headers
  Distribute to worker threads (via flow hash for ordering)

Worker threads (decode + detect):
  Each thread handles a subset of flows
  Per-flow state: conntrack + app-layer parsers + detect engine
  Hyperscan/AC for payload inspection
  Produces: alert events, flow records, file extracts

Output threads:
  Write alerts: EVE JSON, Unified2 (for Snort-compatible output)
  Write flow records: NetFlow-like summaries
  Write extracted files: malware samples, documents from HTTP/SMTP

/* Suricata packet flow */
Packet → RX Thread → Flow Hash → Worker Thread:
  1. IP defragmentation (reassemble fragments)
  2. Stream tracking (TCP segment reassembly)
  3. App-layer detection (HTTP, TLS, DNS, SMTP, SMB parsers)
  4. Rule detection (Hyperscan + keyword matching)
  5. Action (alert/drop/pass)
  6. Logging (EVE JSON)

/* Suricata AF_XDP mode (high performance) */
suricata:
  af-xdp:
    interface: eth0
    threads: 4
    xdp-mode: driver
    use-mmap: yes
    ring-size: 2048

/* Suricata IPS mode (inline with NFQUEUE or AF_PACKET) */
# NFQUEUE mode: Netfilter sends packets to Suricata for verdict
iptables -A FORWARD -j NFQUEUE --queue-num 0

suricata:
  nfq:
    mode: accept
    fail-open: yes   /* pass traffic if Suricata crashes */

# AF_PACKET IPS mode (bypass when possible)
suricata:
  af-packet:
    - interface: eth0
      cluster-id: 99
      cluster-type: cluster_flow
      copy-mode: ips
      copy-iface: eth1   /* forward to eth1 if not dropped */

/* Suricata EVE JSON output — structured logging */
{
  "timestamp": "2024-01-15T10:23:45.123456+0000",
  "flow_id": 123456789,
  "event_type": "alert",
  "src_ip": "192.168.1.50",
  "src_port": 54321,
  "dest_ip": "198.51.100.5",
  "dest_port": 443,
  "proto": "TCP",
  "alert": {
    "action": "blocked",
    "gid": 1,
    "signature_id": 2019401,
    "rev": 4,
    "signature": "ET CNC Feodo Tracker Reported C2 in Use",
    "category": "A Network Trojan was Detected",
    "severity": 1
  },
  "tls": {
    "sni": "malicious.example.com",
    "version": "TLS 1.3",
    "ja3": { "hash": "51c64c77e60f3980eea90869b68c58a8" }
  },
  "app_proto": "tls"
}

/* The false positive problem */
/* A well-tuned IPS might have 0.01% false positive rate */
/* At 10 Gbps with 64-byte packets: 19.5 Mpps */
/* 0.01% = 1950 false blocks per second → completely unusable */
/* Tuning is as important as detection capability */

/* Step 1: Profile your traffic before enabling IPS */
/* Run in IDS mode for 2 weeks. Collect EVE JSON. Analyse alerts. */
/* Key question: which rules fire most? Are those FPs or TPs? */

/* Alert classification */
/* TP (True Positive):  Real attack. Alert is correct. */
/* FP (False Positive): Legitimate traffic wrongly alerted. */
/* FN (False Negative): Real attack missed (no alert). */
/* TN (True Negative):  Legitimate traffic, no alert. */

/* Tuning approaches */

1. Threshold tuning:
   /* Rule fires every packet — add threshold to reduce noise */
   alert:threshold:type limit,track by_src,count 1,seconds 300;
   /* Only alert once per source per 5 minutes */

2. Suppress rules for known-good sources:
   suppress gen_id 1, sig_id 2001219, track by_src, ip 10.1.0.0/24;
   /* Suppress SSH brute force rule for internal hosts */

3. Pass rules (whitelist before detect):
   pass tcp $TRUSTED_SCANNERS any -> $HOME_NET any
   /* Vulnerability scanner — don't alert on its port scans */

4. Score-based alerting:
   /* Don't block on single rule match */
   /* Accumulate score across multiple correlated events */
   /* Block only when score > threshold */

typedef struct {
    uint32_t src_ip;
    uint32_t score;          /* accumulated threat score */
    uint64_t reset_time_ns;  /* when to reset score */
    char     events[16][64]; /* last 16 contributing events */
} threat_score_t;

void threat_score_update(threat_score_t *ts, const char *sig, uint32_t weight) {
    ts->score += weight;
    /* Log contributing event */
    snprintf(ts->events[ts->score % 16], 64, "%s", sig);

    if (ts->score >= 100) {
        quarantine_host(ts->src_ip);   /* automatic response */
        ts->score = 0;
    }
}

/* Score weights */
/* JA3 matches known malware:  30 points */
/* DNS query to known-bad domain: 40 points */
/* Port scan (>50 ports/min):  20 points */
/* Connection to C2 IP:         70 points */
/* Lateral movement (SMB spray): 50 points */

/* 5. Exception list maintenance */
/* Keep a structured exception database */
/* Every exception needs: justification, owner, expiry date */
/* Exceptions without expiry become permanent security holes */

/* 6. Rule set management */
/* Emerging Threats Pro rules: ~40,000 rules */
/* Typical production deployment: enable 20% of rules */
/* Categories to always enable: malware, c2, exploit */
/* Categories to carefully evaluate: policy, info, dos */