Analyst Tools
The dual-homed sensor and analysis workstation. Management traffic uses ens160. The interface ens192 is promiscuous, carries no IP address, and is what Suricata reads. Suricata’s configuration is separated below from the runtime concerns of starting, testing, and version-pinning the engine, because the two are edited at different times and for different reasons.
| Tool | Path / Command | What It Does |
|---|---|---|
| Wazuh Agent | /var/ossec/etc/ossec.conf |
The agent’s settings: which logs to collect, which directories to watch, where to send results. |
/var/ossec/logs/ossec.log |
The agent’s own log. Shows connection attempts and enrollment problems. | |
| Suricata config | /etc/suricata/suricata.yaml |
The sensor’s master settings file. Sets the capture interface (ens192), which outputs are on, and which rule files load. |
/etc/suricata/rules/ |
Where your own hand-written rules live, kept separate from the downloaded feed. | |
/var/lib/suricata/rules/suricata.rules |
One merged file holding every rule suricata-update pulled down. This is what the engine actually loads. | |
/etc/suricata/enable.conf |
Forces specific rule IDs back on even when the feed ships them disabled. | |
/etc/suricata/disable.conf |
Silences specific rule IDs that are too noisy in your environment. | |
/etc/suricata/threshold.config |
Rate-limits or suppresses an alert without deleting the rule. Try this before disabling anything. | |
/etc/suricata/classification.config |
Maps alert categories to readable names and default priorities. | |
/etc/suricata/reference.config |
Expands short reference tags inside rules into full URLs. | |
/var/log/suricata/eve.json |
The main output. Alerts, flows, DNS, TLS and HTTP records, one JSON object per line. This is the file Wazuh reads. | |
/var/log/suricata/fast.log |
One line per alert. Good for a quick did-it-fire check. | |
/var/log/suricata/stats.log |
Counters for packets seen, processed, and dropped. Drops here mean the sensor is losing traffic. | |
/var/log/suricata/suricata.log |
Engine startup messages and errors. Check here when the service won’t start. | |
| Suricata runtime | /usr/bin/suricata |
The engine binary itself. |
suricata --build-info |
Prints version and compiled-in features. Confirms you are on the pinned 8.0.6. | |
suricata -T -c /etc/suricata/suricata.yaml |
Tests the configuration without starting the service. Always run before restarting. | |
/lib/systemd/system/suricata.service |
The vendor’s service definition. Don’t edit it — override it. | |
/etc/systemd/system/suricata.service.d/override.conf |
The lab’s service tweak, layered on the vendor unit so package upgrades don’t wipe it. (Appendix A.12 Step 8) | |
/var/run/suricata.pid |
The process ID of the running engine. | |
/var/run/suricata-command.socket |
Control channel for issuing commands to a running Suricata without restarting it. | |
apt-mark hold suricata |
Freezes the package version so an unattended upgrade can’t change your validated baseline. | |
apt-mark showhold |
Lists frozen packages. Use it to prove the pin actually took. | |
| Emerging Threats | /etc/suricata/update.yaml |
Configures suricata-update: which sources to pull and where output is written. |
/var/lib/suricata/update/sources/ |
One file per enabled feed describing where to fetch it. | |
/var/lib/suricata/update/cache/ |
Raw downloaded rule archives before merging. Delete to force a clean re- fetch. | |
/var/lib/suricata/rules/suricata.rules |
The merged result Suricata loads. Overwritten on every update — never edit it by hand. | |
/var/lib/suricata/rules/classification.config |
Merged category definitions that arrive with the feed. | |
suricata-update |
Downloads the current feed and merges it. Run it, then restart Suricata. | |
suricata-update list-sources |
Shows every feed available, free and paid. | |
suricata-update list-enabled-sources |
Shows which feeds you have actually turned on. | |
| Auditd | /etc/audit/auditd.conf |
How the audit daemon behaves: log size, rotation, and what to do when the disk fills. |
/etc/audit/rules.d/*.rules |
Your audit rules, split across files. These survive a reboot. | |
/etc/audit/audit.rules |
The compiled ruleset assembled from rules.d and loaded at boot. Generated — don’t hand-edit. | |
/var/log/audit/audit.log |
The raw record of system calls: who ran what, who touched which file. Wazuh reads this directly. | |
/sbin/auditctl |
Loads, lists, or clears audit rules on a running system. | |
/sbin/ausearch |
Searches the audit log by user, file, syscall, or time. Far easier than grep. | |
/sbin/aureport |
Summarizes the audit log into counts and top-N reports. | |
ossec.conf → <log_format>audit</log_format> |
Tells the Wazuh agent to read audit.log and apply audit-format decoding. | |
| tcpdump | /usr/bin/tcpdump |
The capture binary. |
/etc/apparmor.d/usr.sbin.tcpdump |
Example profile path; installation and enforcement vary. Check aa-status and the active profile when diagnosing a denied write. | |
ens192 (interface) |
The capture interface: promiscuous, no IP address, sees all mirrored traffic. | |
setcap cap_net_raw,cap_net_admin+eip /usr/bin/tcpdump |
Grants capture rights to a non-root user without handing out full sudo. | |
tcpdump -i ens192 -w /var/tmp/cap.pcap |
Example capture path. Confirm directory permissions and enforced AppArmor rules; sudo does not override profile restrictions. | |
tcpdump -i ens192 -G 3600 -w /var/tmp/cap-%Y%m%d-%H%M.pcap |
Rolls to a new file every hour so captures stay a manageable size. | |
| Nmap | /usr/bin/nmap |
The scanner binary. |
/usr/share/nmap/scripts/ |
The NSE script library: hundreds of add-on checks for services and vulnerabilities. | |
/usr/share/nmap/scripts/script.db |
Index of those scripts. Rebuild with nmap --script-updatedb after adding your own. |
|
/usr/share/nmap/nmap-services |
Maps port numbers to service names for default scan output. | |
/usr/share/nmap/nmap-os-db |
Fingerprints used to guess a target’s operating system. | |
/usr/share/nmap/nmap-service-probes |
Probes used to identify the exact software version behind an open port. | |
C:\Program Files (x86)\Nmap\ |
Windows install location, including the Zenmap GUI. | |
| jq | /usr/bin/jq |
The binary. Reads JSON on standard input and writes filtered JSON out. |
~/.jq |
Optional file for filters you reuse often, so you don’t retype them. | |
jq -c 'select(.event_type=="alert")' |
Keeps only alert records from eve.json and prints each on one line. | |
jq -r '.rule.description' |
Pulls a single field out and prints it without surrounding quotes. | |
tail -f eve.json | jq -c ... |
Watches alerts arrive in real time while you generate traffic. | |
| xxd | /usr/bin/xxd |
The binary. Installed as part of the vim-common package. |
xxd -l 64 <file> |
Shows the first 64 bytes — enough to identify a file’s real type from its magic number. | |
xxd -p <file> |
Plain hex with no offsets or ASCII column, suitable for piping. | |
xxd -r <file> |
Turns a hex dump back into the original binary. | |
Format-Hex (PowerShell) |
The Windows equivalent when working on WIN11. | |
| NuShell (optional) | /usr/bin/nu |
The shell binary. |
~/.config/nushell/config.nu |
Prompt, aliases, and display settings. | |
~/.config/nushell/env.nu |
Environment variables and PATH. | |
%APPDATA%\nushell\ |
Windows configuration location. | |
open --raw eve.json | from json --objects |
Parse EVE JSON Lines into records. Pipe the result to a where filter on event_type to select alerts. | |
| Volatility 3 | ~/.venvs/ata/bin/vol |
The command you actually run, installed inside a Python virtual environment. |
~/volatility3/vol.py |
Alternative: run straight from a cloned source tree. | |
volatility3/symbols/windows/ |
Symbol files telling Volatility how a given Windows build lays out memory. Downloaded automatically. | |
volatility3/symbols/linux/ |
Linux symbol tables. These you must build yourself from the target kernel. | |
~/.cache/volatility3/ |
Preserve cache and symbol state for reproducibility. For diagnosed cache faults, document the issue and preserve needed data before using the documented --clear-cache option. |
|
vol -f mem.raw windows.info |
First command on any Windows image: confirms it is readable and identifies the build. | |
vol -f mem.raw windows.pslist |
Lists running processes as the operating system saw them. | |
vol -f mem.raw windows.netscan |
Recovers network connections from memory, including ones already closed. |
Check the active controls rather than inferring them from a permissions error. An enforced AppArmor profile can restrict where tcpdump writes; inspect aa-status, the profile and denial logs, as well as ordinary file permissions. If pip reports an externally managed environment, use a virtual environment instead of bypassing the distribution protection.
Suricata EVE contains one JSON object per line. In NuShell, parse that stream explicitly before filtering:
open --raw eve.json | from json --objects | where event_type == "alert"