Translate Suricata IPS signatures into custom Palo Alto Networks threat signatures

[kvarshney]

Threat Prevention goes beyond a typical intrusion prevention system (IPS) to inspect all traffic for threats (regardless of port, protocol, or encryption), and automatically blocks known vulnerabilities, malware, exploits, spyware, and command-and-control. Customers can easily automate workflows to rapidly apply IPS signatures in popular formats such as Snort and Suricata, and take advantage of our enhanced threat coverage. 

Suricata is an open-source intrusion detection system developed by the Open Information Security Foundation. It can identify complex malicious patterns in network traffic using customizable rules, and therefore it is able to detect sophisticated attacks beyond basic signature-based detection. 

Suricata is supported by a large community contributing to its development.  Therefore, Suricata is used by many organizations as a complementary security tool to create custom signatures, which are tailored to their environment. 

Being an open source tool, it can be easily integrated into Palo Alto Networks next gen firewalls, using Panorama version 10.0 or higher.

Let us review the process of signature conversion, which is a 3-step process. 

• Install or update the latest IPS Signature Converter plugin for Panorama.

• Upload and convert Suricata signatures into the custom threat signatures. 

• Import them into Panorama, and finally push these to your device group.

Let us dive directly into this 3-steps demo …

[kiwi]

Hi @kvarshney ,

Great explanation in the video !

Thanks,

-Kim.