Technology and tools
What is Suricata?
An open-source network intrusion detection and prevention engine that inspects traffic against signature rules.
Suricata is an open-source network threat detection engine that works as an IDS, an inline IPS and a network security monitor. It matches traffic against signature rules, compatible with the Snort rule format, and can also log protocol metadata and extract files.
Community and commercial rule sets cover exploits, malware C2 and policy violations. Detection engineers also write custom Suricata rules from threat reports.