Blocking Malicious IP’s using Suricata
In the previous post we saw how we can install Suricata in Ubuntu, in this post let’s see how we can use Suricata to block requests from Malicious IP’s. You can find Suricata installation guide here . Before stating we need python and pip installed in the machine, sudo apt-get update sudo apt-get install python3 sudo apt-get install python3-pip Once you have successfully installed python and pip, install requests using pip. pip install requests Now head to AbuseIPDB and create an account (free account will work for test purposes, use can go for paid accounts if required) and create an API key and copy the key. Save the below python code into a file and name it as maliciousIPs.py import requests import json def update_suricata_rules ( malicious_ips ): with open ( '/var/lib/suricata/rules/block_ips.rules' , 'a' ) as rule_file: sid = 100001 for ip in malicious_ips: rule_file.write( f'drop ip {ip} any -> any any (msg:"
