16:45:32 · LOCAL EICAR Test File Detected · 10.10.50.21 → 10.10.50.20 · sev 116:57:15 · LOCAL Possible Port Scan Detected · 10.10.50.20 → 10.10.50.21 · ×98116:54:23 · ET INFO GNU/Linux APT User-Agent Outbound · sev 316:06:58 · ET INFO GNU/Linux APT User-Agent Outbound · sev 316:45:32 · LOCAL EICAR Test File Detected · 10.10.50.21 → 10.10.50.20 · sev 116:57:15 · LOCAL Possible Port Scan Detected · 10.10.50.20 → 10.10.50.21 · ×98116:54:23 · ET INFO GNU/Linux APT User-Agent Outbound · sev 316:06:58 · ET INFO GNU/Linux APT User-Agent Outbound · sev 3
SIEM-LITE + INTRUSION DETECTION LAB
Proving you can catch an attack while it's happening.
A passive detection lab on real Cisco, Fortinet, and Proxmox hardware — a dedicated VLAN, a live Suricata sensor running 52,713 real signatures, and two independently verified detections: a malware-signature transfer and a live port scan.
Every VLAN 50 packet — container or not — passes through Proxmox's own VLAN-aware sub-bridge before it ever reaches the physical switch. Suricata watches that point directly.
A design decision worth noting — the original plan mirrored traffic via switch-side RSPAN. That hit a real, documented Cisco hardware limitation (Finding 01, below) and was replaced with host-level capture on Proxmox's own VLAN sub-bridge — simpler, more reliable, and the more correct pattern when the sensor shares a hypervisor with the traffic it watches.
02
The dashboard
Real detections, aggregated and triaged — not a wall of raw log lines.
981 port-scan alerts collapsed into one row · EICAR surfaced at severity 1Flask + SQLite
03
Investigation log
Three real, reproducible problems, root-caused during this build. The diagnostic process is the actual evidence of engineering judgment — not just the final config.
01
Same-port RSPAN silently drops unicast traffic
SYMPTOM
ARP and STP frames appeared on the mirrored interface immediately. A real ping between two hosts on the mirrored VLAN never did — reproduced three separate times before treating it as a real finding.
ROOT CAUSE
The switch was asked to mirror VLAN 50 back out the same trunk port already carrying that traffic live. Cisco documents this exactly: a frame that would be both forwarded and mirrored out one port has its mirror copy suppressed to prevent a loop.
FIX
Dropped switch-side mirroring entirely. Every VLAN 50 host already crosses Proxmox's own VLAN sub-bridge — Suricata watches that directly instead.
30-second capture during an active ping — only broadcast/control traffic visible
02
Third-party EICAR mirrors transparently redirect to HTTPS
SYMPTOM
Downloading the standard EICAR test file completed successfully every time. Suricata never alerted.
ROOT CAUSE
Every convenient EICAR source — including the one labeled "official" — transparently redirects to HTTPS. The download was genuine; the content was structurally invisible to a passive sensor by design.
FIX
Self-hosted the verified official EICAR string over plain HTTP, fetched from a separate container to guarantee real, inspectable, cross-host traffic.
The redirect chain — HTTP request, HTTPS response
03
Default ruleset has no rule for a fast, small port scan
SYMPTOM
A full 1,000-port nmap scan completed in under half a second. Zero alerts fired from the stock Emerging Threats Open ruleset.
ROOT CAUSE
ET Open ships no generic, low-threshold connection-rate rule tuned to this pattern out of the box — a real gap between "installed a ruleset" and "tuned to the environment."
FIX
Wrote a custom detection_filter rule: 20+ new connections from one source within 5 seconds. Retested — fired immediately, all 981 matches aggregated into one triageable row.
The scan that triggered the finding — 1,000 ports, under half a second
04
Verification
Claim
Result
VLAN 50 isolated, internet-only
✓ Confirmed
Sensor sees real unicast traffic, not just broadcast
✓ Confirmed on vmbr0v50
Ruleset loads clean
✓ 52,713 rules, 0 failed
Malware-signature detection fires
✓ Severity 1, real transfer
Port-scan detection fires
✓ 981 alerts, aggregated
Survives a reboot
✓ systemd + cron
05
Known limitations
Stated plainly — an honest scope is a stronger signal than a padded one.
DETECTION-ONLYNot inline blocking. This sensor sits on a passive capture point and structurally cannot drop traffic. Any real blocking happens at the FortiGate's own IPS profile, separately.
NO TLS INTERCEPTIONEncrypted payloads are invisible to signature inspection by design — the same limitation every passive, non-MITM IDS shares.
BASIC AGGREGATIONThe dashboard groups identical alerts by signature/source/destination. It doesn't correlate across alert types or with FortiGate logs — deliberately scoped out.
SINGLE-OPERATORNo accounts, no role-based access — this is a lab, not a SOC platform.
06
Stack
Suricata 7.0.10Emerging Threats OpenPython / FlaskSQLitesystemdCisco Catalyst 3560EFortiGate 60EProxmox VE
