Suricata

Suricata is a high-performance, open-source network threat detection, intrusion prevention (IPS), intrusion detection (IDS), and network security monitoring (NSM) engine developed and maintained by the Open Information Security Foundation (OISF). Designed from its foundation with a multi-threaded architecture, Suricata scales across modern multi-core server processors and high-speed network interfaces, inspecting multi-gigabit network traffic streams without dropping packets or degrading network throughput. The engine inspects network traffic using standard rule syntax compatible with Snort rules, while delivering advanced capabilities such as native multi-gigabit protocol parsing, automated file extraction, and full HTTP, DNS, TLS, and SMB protocol logging. Suricata generates standardized, structured JSON security telemetry via its Eve JSON log engine, which integrates seamlessly with modern security data pipelines, SIEMs, and big data search clusters like Elasticsearch and Splunk. In active inline IPS mode, Suricata drops malicious traffic and blocks attacker connections directly on the wire. Suricata provides network defenders and security operations centers with a robust, community-backed network visibility and threat detection foundation.