{"id":77,"date":"2021-10-09T08:50:38","date_gmt":"2021-10-09T08:50:38","guid":{"rendered":"https:\/\/idstower.com\/blog\/?p=77"},"modified":"2026-10-18T03:10:16","modified_gmt":"2026-10-18T03:10:16","slug":"alerting-on-iocs-using-suricata","status":"publish","type":"post","link":"https:\/\/idstower.com\/blog\/alerting-on-iocs-using-suricata\/","title":{"rendered":"Alerting on IOCs using Suricata"},"content":{"rendered":"\n
\n

Updated October 2026:<\/strong> ThreatFox now requires a free Auth-Key on every API request, and returns at most the last seven days of IOCs. The commands below are updated for both and were re-tested on Suricata 7.0 and 8.0.<\/p>\n<\/blockquote>\n\n\n\n

In our previous post, we talked about why you should use Suricata IDS to alert on IOCs<\/a>. Suricata’s Datasets<\/a> feature is what makes that practical: one rule can match traffic against a list of thousands, or millions, of Indicators of Compromise (IOCs), such as malicious domains, IP addresses and file hashes.<\/p>\n\n\n\n

It works in a simple way. You write the indicators to a file, Base64-encoded for strings such as domains and in hex for MD5 and SHA256 hashes, and a Suricata rule loads that file and matches traffic against it<\/strong>.<\/p>\n\n\n\n

In this post we’ll use Datasets to alert on DNS queries to malicious domains published by abuse.ch ThreatFox<\/a>.<\/p>\n\n\n\n

Before you start: get a ThreatFox Auth-Key<\/h2>\n\n\n\n

ThreatFox requires an Auth-Key<\/code> header on every API request; without one, the API answers 401 Unauthorized<\/code>. Keys are free: sign in to the abuse.ch Authentication Portal<\/a> and generate one from your profile.<\/p>\n\n\n\n

You’ll also need curl<\/code> and jq<\/code>:<\/p>\n\n\n\n

sudo apt install -y curl jq<\/code><\/pre>\n\n\n\n
Preparing the IOCs file<\/h2>\n\n\n\n
Put your key in a variable, then download the last seven days of IOCs from the ThreatFox API<\/a>:<\/p>\n\n\n\n
export THREATFOX_AUTH_KEY='your-auth-key'\n\ncurl -s -X POST https:\/\/threatfox-api.abuse.ch\/api\/v1\/ \\\n  -H \"Auth-Key: ${THREATFOX_AUTH_KEY}\" \\\n  -d '{ \"query\": \"get_iocs\", \"days\": 7 }' > iocs_list.json<\/code><\/pre>\n\n\n\n
days<\/code> accepts 1 to 7; any other value returns illegal_days<\/code>. For older indicators, ThreatFox publishes export files<\/a>, which need the same key.<\/p>\n\n\n\n
Check that ThreatFox accepted the request before going further. Without a key you get {\"error\": \"Unauthorized\"}<\/code>, and with a key ThreatFox doesn’t recognise, {\"query_status\": \"unknown_auth_key\"}<\/code>; neither contains any IOCs:<\/p>\n\n\n\n
jq -e '.query_status == \"ok\"' iocs_list.json<\/code><\/pre>\n\n\n\n
It prints true<\/code> and exits with 0 on a good response, which also makes it a handy guard in scripts.<\/p>\n\n\n\n
Now extract the domain IOCs:<\/p>\n\n\n\n
jq -r '.data[] | select(.ioc_type == \"domain\") | .ioc' iocs_list.json | sort -u > domains.txt<\/code><\/pre>\n\n\n\n
Suricata expects a string<\/code> dataset to be Base64-encoded, one entry per line, so encode each domain:<\/p>\n\n\n\n
while IFS= read -r domain; do printf '%s' \"$domain\" | base64 -w 0; echo; done < domains.txt > threatfox_domains.lst<\/code><\/pre>\n\n\n\n
Finally, copy the list next to your rules:<\/p>\n\n\n\n
sudo mkdir -p \/etc\/suricata\/rules\nsudo install -m 644 threatfox_domains.lst \/etc\/suricata\/rules\/<\/code><\/pre>\n\n\n\n
Creating the Suricata rule<\/h2>\n\n\n\n
To alert on DNS queries for any domain in the list, the rule compares the dns.query<\/code> buffer with the dataset:<\/p>\n\n\n\n
alert dns $HOME_NET any -> any any (msg:\"ThreatFox IOC: DNS query for a malicious domain\"; dns.query; dataset:isset,threatfox_domains,type string,load \/etc\/suricata\/rules\/threatfox_domains.lst,memcap 10mb,hashsize 4096; classtype:trojan-activity; sid:1000001; rev:1;)<\/code><\/pre>\n\n\n\n