NIDS - Configuration ( SIEM )

The Network-based Intrusion Detection System (NIDS) tab within the SIEM configuration module allows you to configure and manage network-level threat detection throughout your infrastructure.

Prerequisite for NIDS: 

Requirement is a physical Ubuntu machine with port mirroring data by physical link.

It should mirror ports or VLANs that carry traffic you want to inspect, typically:

1. Uplink Ports / Trunk Ports

• These are the best candidates.
• Why: They carry aggregated traffic to and from access/distribution switches or between core and edge routers.
• Example: If Port 1/1 on your core switch is connected to your firewall, or to another switch/router, mirroring this port will give Suricata visibility into that flow.

2. VLAN or SVI Traffic (if supported)

• If your switch supports VLAN-based SPAN (vSPAN or RSPAN), mirror the VLAN that handles inter-VLAN or internet-bound traffic.
• Example: Mirror VLAN 10 (user subnet) or VLAN 99 (internet-facing subnet).

3. Firewall-facing Port

• If the core switch connects directly to the firewall, mirroring the firewall port will allow Suricata to see all ingress/egress traffic.

In ceburu Portal:

• Go to Settings > Configurations > SIEM

• Click on the NIDS tab 

To set up NIDS monitoring:

1. Click the “Add Configuration” button.

Important Requirements:

• Only Linux machines (preferably Ubuntu) will be shown.

• The Linux machine must be joined to Active Directory (AD).

• The Linux machine must also be under monitoring within the platform.

Once eligible systems are detected:

1. Select the Linux host.

2. Complete the configuration.

3. Save the settings.

The system will then begin monitoring network traffic from the configured host.

After a Linux machine is successfully configured as a NIDS, it will appear in the table with the following columns:

Edit Configuration:

• Click the pencil/edit icon under the Action column.

• You can change the assigned host to another eligible Linux machine.
• And click on update. 

Deleting Configuration:

• Click the delete icon in the Action column to remove the NIDS configuration.