Description
Whether someone is scanning ports or a host is quietly calling a suspicious address cannot be told from router logs alone. Suricata is an open source network threat detection engine that matches traffic against a rule set packet by packet, raises alerts on a hit and can be configured to block as well.
It does more than IDS and IPS: it also records protocol transactions, network flows, packet captures and transferred files for later investigation. The rule syntax is complex, so writing custom rules takes effort for beginners, but community rule sets work out of the box. Windows gets an MSI installer, currently version 8.0.7.
Rule-based alerts:detect port scans, unauthorized logins and malicious traffic by behavior patterns.
Intrusion prevention:run inline and drop traffic that matches a rule.
Protocol and flow logs:output HTTP, DNS and TLS transactions and network flows.
Capture and file extraction:store raw packets and extract files in transit.
Custom rules:write your own rules from action, protocol, port and payload conditions.
It does more than IDS and IPS: it also records protocol transactions, network flows, packet captures and transferred files for later investigation. The rule syntax is complex, so writing custom rules takes effort for beginners, but community rule sets work out of the box. Windows gets an MSI installer, currently version 8.0.7.
Features
Rule-based alerts:detect port scans, unauthorized logins and malicious traffic by behavior patterns.
Intrusion prevention:run inline and drop traffic that matches a rule.
Protocol and flow logs:output HTTP, DNS and TLS transactions and network flows.
Capture and file extraction:store raw packets and extract files in transit.
Custom rules:write your own rules from action, protocol, port and payload conditions.
