Suricata
Suricata is an open source, high-performance network threat detection engine maintained by the Open Information Security Foundation (OISF). It inspects network traffic against signature rules to raise alerts (an IDS), can block traffic when deployed inline (an IPS), and also acts as a network security monitor, logging rich protocol metadata — HTTP requests, DNS queries, TLS handshakes, file transfers, and flows — in structured JSON.
Network detection remains valuable even as traffic is encrypted and endpoints have EDR: it sees devices without agents, catches command-and-control patterns and lateral movement, and provides independent evidence during investigations. Getting value from Suricata depends on placement (seeing the right traffic), rules (relevant and current), tuning (alerts analysts trust), and integration (logs flowing to where analysts work).
TL;DR
- Deploy as an IDS on a tap or span port, or inline IPS where blocking is acceptable; place sensors where traffic matters (internet edge, data center, east–west).
- Load community and commercial rule sets (such as Emerging Threats) with suricata-update, plus your own local rules.
- Rules combine an action, a header (protocol, addresses, ports, direction), and options (sticky buffers, content matches, flow state, metadata).
- Test rules and configuration against packet captures before deploying.
- EVE JSON logs alerts and protocol metadata for your SIEM; correlate with Zeek and endpoint data.
- Tune with HOME_NET, suppression, thresholds, and disabled noisy rules; accept limits on encrypted traffic.
Quick Example
Two local rules using protocol sticky buffers:
Updating rules, testing configuration, and replaying a packet capture to verify detections:
Core Concepts
Deployment Modes
Placement determines visibility: at the internet edge (inbound and outbound traffic), between network segments (east–west movement), in data centers and cloud (VPC traffic mirroring), and near critical assets. Encrypted tunnels and NAT hide details, so place sensors where traffic is visible and addresses are meaningful. See Packet Capture and Network Diagnostics.
Performance
Suricata is multi-threaded. Use AF_PACKET (or DPDK/PF_RING) capture, the workers run mode, and CPU pinning for high throughput; enable Hyperscan for fast pattern matching where available; size memory for flow tables and stream reassembly; and monitor packet drops in stats.log or EVE stats — dropped packets are missed detections.
Rules
suricata-update manages rule sources — Emerging Threats Open by default, plus commercial and community feeds — and merges them with local rules, applying enable, disable, and modify configurations.
EVE JSON Logging
EVE is Suricata's structured output: one JSON object per event, with types such as alert, flow, http, dns, tls, fileinfo, anomaly, and stats. Protocol logs are valuable even without alerts — for hunting and investigations — and can be enriched with Community ID flow hashes to correlate with Zeek and other tools. Ship EVE logs to a SIEM or data lake. See Security Information and Event Management.
Encrypted Traffic
With most traffic encrypted by TLS, payload inspection is limited. Suricata still sees TLS metadata — server name (SNI, unless encrypted ClientHello is used), certificate details, JA3/JA4-style fingerprints in recent versions — plus DNS, flow patterns, and unencrypted protocols inside the network. Decryption at proxies is possible but has privacy and operational costs; combine network detection with endpoint telemetry.
Tuning
Track which rules produce true positives and map coverage to ATT&CK. See MITRE ATT&CK.
Best Practices
Start in IDS Mode
Run passively first, tune alerts, and move to inline blocking only for well-understood rules.
Keep Rules Current and Relevant
Update rule sets daily, enable categories that match your environment, and review new noisy rules.
Test With Packet Captures
Validate custom rules and changes against captures of both malicious and normal traffic.
Log Metadata, Not Only Alerts
Keep EVE protocol logs for hunting and investigations, correlated with other telemetry.
Common Mistakes
Wrong HOME_NET
Blind Sensors
IPS Without Tuning
FAQ
What is Suricata?
An open source network threat detection engine that inspects traffic with signature rules to generate alerts or block traffic, and logs protocol metadata such as HTTP, DNS, TLS, and flows.
What is the difference between Suricata and Zeek?
Suricata focuses on signature-based detection and inline prevention, with protocol logging as well; Zeek focuses on detailed protocol logs and scriptable analysis for monitoring and investigations. Many teams run both. See Zeek.
Can Suricata block traffic?
Yes, when deployed inline in IPS mode, rules with drop or reject actions block matching traffic. In passive IDS mode it only alerts.
How do I keep Suricata rules up to date?
Use suricata-update with your chosen rule sources, run it on a schedule, and reload rules without restarting the engine.
Is network detection still useful with encrypted traffic?
Yes. Metadata such as TLS server names, certificates, fingerprints, DNS queries, and flow patterns still reveal suspicious activity, especially combined with endpoint and log data.
Related Topics
- Security Detection Engineering — Building and maintaining detections
- Zeek — Complementary network security monitoring
- Packet Capture and Network Diagnostics — Capturing and analyzing traffic
- Security Information and Event Management — Where alerts and logs go
- MITRE ATT&CK — Mapping network detections to techniques
- Sigma Detection Rules — Log-based detection rules