Detecting Unauthorized Uploads with Suricata is a practical introduction to writing HTTP detection rules. You will investigate fictional document uploads in recorded packet captures and deliver a working detector that distinguishes prohibited transfers from legitimate traffic.
Two Guided Labs introduce request fields, replay and alert interpretation, then combine destination and document context to reduce noise. A Challenge changes the collector and document type so you can apply the same mechanisms independently.
What You Will Learn
- Read the method, host, URI and body of an HTTP request.
- Write and syntax-test Suricata rules using HTTP sticky buffers.
- Replay synthetic PCAPs and relate JSON alerts to their requests.
- Combine policy conditions and test intended matches alongside benign non-matches.
Who This Course Is For
This course is for beginners interested in network detection. You need basic terminal entry and tab switching; no IDS, programming or packet-analysis experience is required. Each unit provides an independent browser-based Linux terminal, installed engine, packet captures and a recorded traffic reference.
Frequently Asked Questions
Does this block real uploads?
No. Offline alert rules inspect prepared captures. An alert is a match to investigate, not proof of compromise or prevention.
Can it inspect HTTPS bodies?
This course uses synthetic plain HTTP so the fields are visible. It does not teach TLS decryption or claim visibility into encrypted payloads.
What is graded?
The submitted rule runs with the real engine against balanced captures in a clean output directory. You do not submit a report or copied alert log.
