Snort

Snort is an open-source network security technology used to inspect traffic and identify patterns associated with malicious activity. Its rule-based detection engine can operate as an intrusion detection or inline prevention system, while also supporting packet sniffing and traffic logging for troubleshooting and investigation. Snort is widely relevant to security teams that need visibility into network behavior and want the flexibility of a mature, community-driven detection platform. The Cisco Talos team maintains a subscriber ruleset that extends detection coverage with continuously updated signatures. Because Snort works at the network layer, it can complement endpoint and identity controls by exposing suspicious communications and protocol behavior.