PacketStreamer

Distributed tcpdump for cloud native environments.

suricata-kafka-output

Suricata Eve Kafka Output Plugin for Suricata 6.

suricata-redis-output

Suricata Eve Redis Output Plugin for Suricata 7.

Meer

A "spooler" for Suricata / Sagan.

FEVER

Fast, extensible, versatile event router for Suricata's EVE-JSON format.

Suricata-Logstash-Templates

Templates for Kibana/Logstash to use with Suricata IDPS.

Lilith

Reads EVE files into SQL as well as search stored data.

slinkwatch

Automatic enumeration and maintenance of Suricata monitoring interfaces.

suri-stats

A tool to work on suricata `stats.log` file.

Mauerspecht

Simple Probing Tool for Corporate Walled Garden Networks.

ansible-suricata

Suricata Ansible role (slightly outdated).

MassDeploySuricata

Mass deploy and update Suricata IDPS using Ansible IT automation platform.

docker-suricata

Suricata Docker image.

Suricata-Monitoring

LibreNMS JSON / Nagios monitor for Suricata stats.

Terraform Module for Suricata

Terraform module to setup Google Cloud packet mirroring and send packets to Suricata.

InfluxDB Suricata Input Plugin

Input Plugin for Telegraf to collect and forward Suricata `stats` logs (included out of the box in recent Telegraf releases).

suricata_exporter

Simple Prometheus exporter written in Go exporting stats metrics scraped from Suricata socket.

Triagewall

Local-LLM triage layer for Suricata alerts, using a tunable prefilter and Ollama classifier to reduce alert volume.

rust-suricatax-rule-parser

Experimental Suricata Rule Parser in Rust.

go-suricata

Go Client for Suricata (Interacting via Socket).

gonids

Go library to parse intrusion detection rules for engines like Snort and Suricata.

surevego

Suricata EVE-JSON parser in Go.

suricataparser

Pure python parser for Snort/Suricata rules.

py-idstools

Snort and Suricata Rule and Event Utilities in Python (Including a Rule Update Tool).

KTS

Kibana 4 Templates for Suricata IDPS Threat Hunting.

KTS5

Kibana 5 Templates for Suricata IDPS Threat Hunting.

KTS6

Kibana 6 Templates for Suricata IDPS Threat Hunting.

KTS7

Kibana 7 Templates for Suricata IDPS Threat Hunting.

Suricata Language Server

An implementation of the Language Server Protocol for Suricata signatures. It adds syntax check, hints and auto-completion to your preferred editor once it is configured.

suricata-ls-vscode

Suricata IntelliSense Extension using the Suricata Language Server.

suricata-highlight-vscode

Suricata Rules Support for Visual Studio Code (syntax highlighting, etc).

SublimeSuricata

Basic Suricata syntax highlighter for Sublime Text.

Suricata-Check

A command-line utility to provide feedback on Suricata rules. It can detect issues such as covering syntax validity, interpretability, rule specificity, rule coverage, and efficiency.

SEPTun

Suricata Extreme Performance Tuning guide.

SEPTun-Mark-II

Suricata Extreme Performance Tuning guide - Mark II.

suricata-4-analysts

The Security Analyst's Guide to Suricata.

Suricata Community Style Guide

A collaborative document to collect style guidelines from the community of rule writers.

Suricata Analytics

Various resources that are useful when interacting with Suricata data.

Malcolm

A powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Evebox

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search.

nids-rule-library

Collection of various open-source and commercial rulesets.

Stamus Lateral Movement Detection Rules

Suricata ruleset to detect lateral movement.

QuadrantSec Suricata Rules

Set of Suricata rules published by QuadrantSec.

Cluster25/detection

Cluster25's detection rules.

Quantum Insert detection for Suricata

Suricata rules accompanying Fox-IT's QUANTUM 2015 blog/BroCon talk.

Hunting rules

Suricata IDS alert rules for network anomaly detection from Travis Green.

3CORESec NIDS - Lateral Movement

Suricata ruleset focusing on lateral movement techniques (paid).

3CORESec NIDS - Sinkholes

Suricata ruleset focused on a curated list of public malware sinkholes (free).

PAW Patrules

Another free (CC BY-NC-SA) collection of rules for the Suricata engine.

opnsense-suricata-nmaps

OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans.

Antiphishing

Suricata rules and datasets to detect phishing attacks.

Suricata Ruleset Index

OISF's curated, machine-readable list of sources used by Suricata-Update.

EveBox Rules

Suricata Rule Browser, indexes many free rulesets, including rules from the Suricata Ruleset Index.

sidallocation.org

Sid Allocation working group, list of SID ranges.

Scirius

Web application for Suricata ruleset management and threat hunting.

IOCmite

Tool to create dataset for suricata with indicators of MISP instances and add sightings in MISP if an indicator of dataset generates an alert.

luaevilbit

An Evil bit implementation in luajit for Suricata.

Lawmaker

Suricata IDS rule and fleet management system.

surify-cli

Generate suricata-rules from collection of IOCs (JSON, CSV or flags) based on your suricata template.

suricata-prettifier

Command-line tool to format and syntax highlight Suricata rules.

OTX-Suricata

Create rules and configuration for Suricata to alert on indicators from an OTX account.

Aristotle

Simple Python program that allows for the filtering and modifying of Suricata and Snort rulesets based on interpreted key-value pairs present in the metadata keyword within each rule.

suricata-zabbix

Zabbix application layer plugin for Suricata.

SELKS

A Suricata-based intrusion detection system/intrusion prevention system/network security monitoring distribution.

Amsterdam

Docker based Suricata, Elasticsearch, Logstash, Kibana, Scirius aka SELKS.

pfSense

A free network firewall distribution, based on the FreeBSD operating system with a custom kernel and including third party free software packages for additional functionality.

OPNsense

An open source, easy-to-use and easy-to-build FreeBSD based firewall and routing platform.

Artica

Suricata IDS integration for the [Artica](https://artica.systems) gateway appliance.

Shovel

Web interface to explore Suricata EVE outputs, with a primary focus on network analysis in CTF competitions.

Experimental Suricata Training Environment

Suricata Training Environment based on Docker(-Compose).

CDMCS

Cyber Defence Monitoring Course: Rule-based Threat Detection.

Leonidas

Automated Attack Simulation in the Cloud, complete with detection use cases.

speeve

Fast, probabilistic EVE-JSON generator for testing and benchmarking of EVE-consuming applications.

Dalton

Suricata and Snort IDS rule and pcap testing system.

suricata-sample-data

Repository of creating different example suricata data sets.

Suriwire

Wireshark plugin to display Suricata analysis info.

bash_cata

A simple script that processes the generated Suricata eve-log in real time and, based on alerts, adds an ip-address to the MikroTik Address Lists for a specified time for subsequent blocking.

suriGUI

GUI for Suricata + Qubes OS.

SuriGuard

Web-based management system for Suricata IDS/IPS, featuring advanced analytics and visualization capabilities.