Scirius

What this appliance is, and what it is not

This image ships the rule-management core of Scirius CE: Sources, Rulesets, the Suricata instance link and the live rule push. The stack is Suricata 8 from the OISF project's official suricata-stable package repository, so it stays patchable. Scirius is served by gunicorn behind nginx and backed by SQLite.

Scirius CE also has an event-analytics Hunt dashboard that renders Suricata alerts and flows. That feature is built on an Elasticsearch datastore, which is not open source under an OSI-approved license. For that reason, this image does not enable Hunt and installs no Elasticsearch or OpenSearch.

The rule-management workflow, which is the reason most teams run Scirius, is fully functional. The alert-analytics graphs report no data because no event store sits behind them. If you need event analytics, pair this appliance with your own separately licensed analytics stack.

First boot: what happens automatically

This image contains no default administrator and no shared secret. On the first boot of each virtual machine, a one-shot service does the following:

• Generates a fresh Django secret key unique to this machine.
• Initializes an empty database and creates a unique administrator account with a strong random password.
• Fetches the current Emerging Threats Open ruleset directly onto your machine, rather than shipping a ruleset frozen at build time.
• Composes the ruleset into a Default ruleset, registers the Suricata engine, and pushes the ruleset so Suricata is armed with current signatures.
• Writes the credentials to a root-only file.

Because the ruleset is fetched on your own machine, the signatures come from the provider, under the provider's terms, and are current on the day you deploy.

1. Connect and retrieve your credentials

Connect over SSH with the key you selected at deployment. Then read the credentials file for this VM:

sudo cat /root/scirius-credentials.txt

The file lists the admin username (admin), the unique password generated for this machine, a REST API token and the sign-in URL. Store it somewhere safe.

2. Confirm the appliance is running

Check that the three services that make up the appliance are active:

sudo systemctl is-active suricata scirius nginx

Each line should read active.

Scirius answers on port 80 through nginx. The application server itself binds only to loopback. Confirm that the web UI is serving:

curl -s -o /dev/null -w 'scirius login page: HTTP %{http_code}\n' http://127.0.0.1/accounts/login/

You should see HTTP 200.

3. Open the Scirius web UI

Open http://<your-vm-public-ip>/ in a browser. Scirius redirects you to the sign-in page. Sign in as admin with the password from /root/scirius-credentials.txt.

Allow inbound TCP 80 (and 22 for SSH) to the VM in its Azure Network Security Group. For a public deployment, restrict the source ranges to your own networks and put TLS in front (see section 9).

4. Manage rule Sources

The Sources page lists the rule feeds Scirius knows about. First boot has already added and fetched the ETOpen Ruleset feed.

Choose Add Public Source to add another public feed, or Add Custom Source to add your own. Refresh a source to pull its latest rules. Scirius versions each source in a local git repository, so you can see exactly what changed between updates.

5. Compose and inspect the Ruleset

The Rulesets page shows the composed rulesets. First boot created the Default ruleset from the ETOpen source.

Open a ruleset to see every category it draws from and the total rule count. From there you can enable or disable whole categories and export the generated rules file. You can also apply transformations, for example converting alert rules to drop rules for an inline IPS deployment.

6. Verify Suricata is armed with the pushed ruleset

Each time you push a ruleset, Scirius writes it to /var/lib/scirius/rules/scirius.rules and this appliance reloads Suricata live. Count the rules that Scirius pushed:

wc -l < /var/lib/scirius/rules/scirius.rules

The full ETOpen ruleset gives tens of thousands of rules. Confirm that Suricata accepts the ruleset:

sudo suricata -T -c /etc/suricata/suricata.yaml

The output reports that the configuration and rules loaded successfully.

Suricata reads its ruleset from the directory Scirius pushes to (default-rule-path: /var/lib/scirius/rules, rule-files: [scirius.rules]). The web UI is therefore the single source of truth for what the engine detects.

7. Administer from the command line

Scirius includes a management CLI, so you can run the same operations from a script or a scheduled job:

sudo scirius-manage help 2>&1 | head -20

To re-fetch every source and push the refreshed ruleset to Suricata in one step, run sudo scirius-manage updatesuricata. This command contacts the rule providers over the network, so this walk-through does not run it.

8. No Elasticsearch is installed

Confirm that the appliance ships the rule-management core only, with no Elasticsearch or OpenSearch datastore:

dpkg -l 2>/dev/null | grep -icE '^ii (elasticsearch|opensearch)' || echo 0

The command prints 0. Nothing from the Elasticsearch or OpenSearch family is installed, and nothing listens on the Elasticsearch port.

9. Secure by default

No two deployments of this image share a secret. The secret key and administrator password are generated on each machine's own first boot. The shipped image contains no database, no administrator and no usable credential.

For a production deployment, do the following:

• Put TLS in front of nginx. Terminate HTTPS with your own certificate, or add a reverse proxy or Azure Application Gateway. Restrict the Network Security Group to your own source ranges.
• Change the administrator password after first sign-in. Create individual accounts for your team from the admin area.
• Keep the operating system current. Unattended security upgrades are enabled and also cover the OISF suricata-stable repository that Suricata is installed from, so the engine is patched through the same path.

Support

This is a repackaged open source product. Scirius CE is GPL-3.0 and Suricata is GPL-2.0. SecureAnyCloud support services carry additional charges.

Our engineers provide 24/7 support for deployment, upgrades, TLS termination, custom rule sources, Suricata tuning and scaling. Scirius and Suricata are trademarks of their respective owners. Use of the names here is nominative and does not imply affiliation or endorsement.

Deploy on Azure

Launch Scirius Community Edition on Ubuntu 24.04 LTS with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com