Repository navigation
docs(ids): Suricata is live on Degens (VLAN 10) — close #89 - #244
Merged
Merged
Conversation
…nd interface taught (#89) Degens went live at 16:30 PDT on 2026-09-02, alert-only, Log Facility local2, so syslog.alloy labels it igc0.10. The first alert arrived two seconds after the engine started, labelled, and was sid 2210044 — the same stream-timestamp signature that is 79% of Skids. Zero unlabelled alerts since; the cross- segment query returned 0, so the two processes do not double-count. The pipeline test failed twice before it passed, and both failures are now in the runbook because both looked exactly like a broken syslog path: - "Restart" on the interface left the process stopped until started by hand, and loading 22k rules then took 35 s. A test visited in that window fires nothing. - A guest iPhone with iCloud Private Relay put no plaintext DNS or HTTP on igc0.10 at all, so neither test rule could fire from it. §4's DoH caveat covered half of this. A laptop's curl fired the DNS rule (three lookups, one millisecond) and, unexplained, not the HTTP rule. The engine's own alerts.log on morpheus is what separates "never fired" from "fired and lost", and the runbook now says so. security.md and observability.md stop saying "Skids only". roadmap.md moves #89 to Done; the fortnight comparison of 2210044 is dated 2026-09-16 in the runbook rather than holding the issue open. Closes #89 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
A few newly added doc lines have grammatical/wording issues that should be corrected for clarity and accuracy before merge.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates the documentation to reflect that Suricata IDS is now running alert-only on both Skids (VLAN 20) and Degens (VLAN 10), and records the operational learnings from bringing up the second interface.
Changes:
- Update security/observability docs to state Suricata runs on Skids + Degens with per-interface labeling.
- Expand the Suricata enablement runbook with concrete “gotchas” (restart behavior, rule-load timing, Private Relay visibility) and a measured-baseline section.
- Move issue #89 from “Monitoring” to “Done” in the roadmap with a brief postmortem-style summary.
File summaries
| File | Description |
|---|---|
| docs/security.md | Updates current-state security posture to include Degens and per-interface labeling. |
| docs/runbooks/enable-suricata.md | Adds per-interface verification callouts and measured observations for Degens enablement. |
| docs/roadmap.md | Marks #89 done and summarizes the implementation/operational findings. |
| docs/observability.md | Updates observability limits section to reflect two-interface Suricata deployment. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+545
to
+548
| > tunnels DNS *and* HTTP, so the phone that seems the obvious guest client | ||
| > produced no port-53 and no port-80 packet on `igc0.10` at all — measured with | ||
| > `tcpdump -i igc0.10 -n port 53 or port 80` on `morpheus`, which is the query | ||
| > that settles "is this device's traffic even visible". §4's caveat about DoH |
Comment on lines
+573
to
+575
| two callouts above) — and the syslog path is not the suspect. A line there | ||
| and nothing in Loki is the syslog path, and §4's *Remote Syslog Contents* | ||
| check is where to go. |
Comment on lines
+30
to
+31
| **Intrusion detection is running** on **Skids (VLAN 20)** since 2026-08-21 and | ||
| on **Degens (VLAN 10)** since 2026-09-02, one Suricata process per interface. |
"tcpdump" is a command, not a query; the alerts.log paragraph now says the syslog path *is* the suspect rather than reading as if it were the result; and "has been running ... since" for the two enable dates. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…9-812654 # Conflicts: # docs/roadmap.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Suricata now watches Degens (VLAN 10) as well as Skids, alert-only on both, one process per interface. This PR is docs only — the pipeline change (facility →
interfacelabel, per-interface rules and panels) merged in #242; this is the operational half done and written down.Measured today (2026-09-02):
local2→interface="igc0.10". First alert 2 s after "Engine started", labelled, sid 2210044 — the same signature that is 79% of Skids.SuricataHighPriorityAlert/SuricataAlertStorm: not firing.igc0.10, priority 3, filterlog still climbing. Test rules deleted afterwards.What the second interface taught, now in the runbook:
igc0.10at all — neither test rule can fire from it. A laptop'scurlfired the DNS rule three times; the HTTP rule never fired (unexplained, noted).alerts.logonmorpheusis what separates "never fired" from "fired and lost".Docs touched:
security.mdandobservability.mdno longer say "Skids only";roadmap.mdmoves #89 to Done;enable-suricata.md§6 gains the callouts above and a "Measured on this network" subsection with the fortnight revisit of 2210044 dated 2026-09-16.Closes #89
Test plan
make lintandmake check-docspasssum by (interface) (count_over_time({app="suricata"}[10m]))showsigc0.10andigc0.20, no unlabelled rowhomelab-security$interfacepicker listsigc0.10🤖 Generated with Claude Code