Suricata: a network intrusion detection and prevention engine

Suricata (about 6,700 stars on GitHub) is a high performance network intrusion detection system (IDS), intrusion prevention system (IPS) and network security monitoring engine. It is developed by the Open Information Security Foundation (OISF), a non profit created in 2009 with initial funding from the United States Department of Homeland Security, and the first stable release appeared in 2010. The engine is written in C with a growing share of Rust for protocol parsers, and it is multi threaded from the ground up so that one machine can inspect ten gigabit links and more.

What it does

Suricata watches a copy of network traffic, either from a mirror port, a network tap or inline between two interfaces. It reassembles streams, decodes dozens of application protocols such as HTTP, TLS, DNS, SMB and SSH, and checks everything against a rule set. Each rule describes a pattern of malicious traffic, for example a known exploit payload or a request to a command and control domain. When a rule matches, Suricata writes an alert; in IPS mode it can also drop the packet. Independently of alerts it produces detailed JSON logs of every connection, DNS query, TLS certificate and transferred file through its EVE output, which is why many teams run it purely as a logging sensor feeding a SIEM.

Rules

Suricata uses the same rule language family as Snort, so a large body of public signatures applies. The most used free set is Emerging Threats Open, maintained by Proofpoint, and the project’s own suricata-update tool downloads and merges rule sources. Commercial rule feeds are available from several vendors.

How to install it

Packages exist for all major Linux distributions, FreeBSD, macOS and Windows, and the OISF maintains a personal package archive for Ubuntu with current releases. A minimal trial on a Linux server looks like this:

sudo apt install suricata
sudo suricata-update
sudo suricata -i eth0

Point the interface option at the network card that sees the traffic you want to inspect, then watch eve.json in the log directory. The documentation covers capture methods, performance tuning and inline deployment. Suricata is also bundled in Security Onion, pfSense and OPNsense.

Credit

Suricata is maintained by the OISF team and contributors from vendors and research groups worldwide. It is licensed under the GNU General Public License version 2.