[[
wikihub
]]
Search
⌘K
Explore
People
For Agents
Sign in
Explore
People
For Agents
Sign in
@harrisonqian / Awesome / wiki/security/suricata.md
Suggest edit
Cancel
Submit suggestion
Title
Name
Note
--- visibility: public --- # Suricata **repo:** [satta/awesome-suricata](https://github.com/satta/awesome-suricata) **category:** [[security|Security]] --- # Awesome Suricata [](https://awesome.re) [<img src="https://suricata.io/wp-content/uploads/2022/01/Logo-SuricataFinal-1-translucent.png" align="right" width="120">](https://suricata.io) > Curated list of awesome things related to Suricata. [Suricata](https://suricata.io/features) is a free intrusion detection/prevention system (IDS/IPS) and network security monitoring engine. ## Contents - [Input Tools](#input-tools) - [Output Tools](#output-tools) - [Operations, Monitoring and Troubleshooting](#operations-monitoring-and-troubleshooting) - [Programming Libraries and Toolkits](#programming-libraries-and-toolkits) - [Dashboards and Templates](#dashboards-and-templates) - [Development Tools](#development-tools) - [Documentation and Guides](#documentation-and-guides) - [Analysis Tools](#analysis-tools) - [Rule Sets](#rule-sets) - [Rule/Security Content Management and Handling](#rulesecurity-content-management-and-handling) - [Plugins and Extensions](#plugins-and-extensions) - [Systems Using Suricata](#systems-using-suricata) - [Training](#training) - [Simulation and Testing](#simulation-and-testing) - [Data Sets](#data-sets) - [Misc](#misc) ## Input Tools - [PacketStreamer](https://github.com/deepfence/PacketStreamer) - Distributed tcpdump for cloud native environments. ## Output Tools - [suricata-kafka-output](https://github.com/Center-Sun/suricata-kafka-output) - Suricata Eve Kafka Output Plugin for Suricata 6. - [suricata-redis-output](https://github.com/jasonish/suricata-redis-output) - Suricata Eve Redis Output Plugin for Suricata 7. - [Meer](https://github.com/quadrantsec/meer) - A "spooler" for Suricata / Sagan. - [FEVER](https://github.com/DCSO/fever) - Fast, extensible, versatile event router for Suricata's EVE-[JSON](/@harrisonqian/awesome/wiki/miscellaneous/json) format. - [Suricata-Logstash-Templates](https://github.com/pevma/Suricata-Logstash-Templates) - Templates for Kibana/Logstash to use with Suricata IDPS. - [Lilith](https://github.com/VVelox/Lilith) - Reads EVE files into SQL as well as search stored data. ## Operations, Monitoring and Troubleshooting - [slinkwatch](https://github.com/DCSO/slinkwatch) - Automatic enumeration and maintenance of Suricata monitoring interfaces. - [suri-stats](https://github.com/regit/suri-stats) - A tool to work on suricata `stats.log` file. - [Mauerspecht](https://github.com/DCSO/mauerspecht) - Simple Probing Tool for Corporate Walled Garden Networks. - [ansible-suricata](https://github.com/GitMirar/ansible-suricata) - Suricata [Ansible](/@harrisonqian/awesome/wiki/miscellaneous/ansible) role (slightly outdated). - [MassDeploySuricata](https://github.com/pevma/MassDeploySuricata) - Mass deploy and update Suricata IDPS using [Ansible](/@harrisonqian/awesome/wiki/miscellaneous/ansible) IT automation platform. - [docker-suricata](https://github.com/jasonish/docker-suricata) - Suricata [Docker](/@harrisonqian/awesome/wiki/back-end-development/docker) image. - [Suricata-Monitoring](https://github.com/VVelox/Suricata-Monitoring) - LibreNMS [JSON](/@harrisonqian/awesome/wiki/miscellaneous/json) / Nagios monitor for Suricata stats. - [Terraform Module for Suricata](https://github.com/onetwopunch/terraform-google-suricata) - [Terraform](/@harrisonqian/awesome/wiki/back-end-development/terraform) module to setup [Google Cloud](/@harrisonqian/awesome/wiki/platforms/google-cloud) packet mirroring and send packets to Suricata. - [InfluxDB Suricata Input Plugin](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/suricata) - Input Plugin for Telegraf to collect and forward Suricata `stats` logs (included out of the box in recent Telegraf releases). - [suricata_exporter](https://github.com/corelight/suricata_exporter) - Simple [Prometheus](/@harrisonqian/awesome/wiki/miscellaneous/prometheus) exporter written in Go exporting stats metrics scraped from Suricata socket. ## Programming Libraries and Toolkits - [rust-suricatax-rule-parser](https://github.com/jasonish/rust-suricatax-rule-parser) - Experimental Suricata Rule Parser in [Rust](/@harrisonqian/awesome/wiki/programming-languages/rust). - [go-suricata](https://github.com/ks2211/go-suricata) - Go Client for Suricata (Interacting via Socket). - [gonids](https://github.com/google/gonids) - Go library to parse intrusion detection rules for engines like Snort and Suricata. - [surevego](https://github.com/rhaist/surevego) - Suricata EVE-[JSON](/@harrisonqian/awesome/wiki/miscellaneous/json) parser in Go. - [suricataparser](https://github.com/m-chrome/py-suricataparser) - Pure [python](/@harrisonqian/awesome/wiki/programming-languages/python) parser for Snort/Suricata rules. - [py-idstools](https://github.com/jasonish/py-idstools) - Snort and Suricata Rule and Event Utilities in [Python](/@harrisonqian/awesome/wiki/programming-languages/python) (Including a Rule Update Tool). ## Dashboards and Templates - [KTS](https://github.com/StamusNetworks/KTS) - Kibana 4 Templates for Suricata IDPS Threat Hunting. - [KTS5](https://github.com/StamusNetworks/KTS5) - Kibana 5 Templates for Suricata IDPS Threat Hunting. - [KTS6](https://github.com/StamusNetworks/KTS6) - Kibana 6 Templates for Suricata IDPS Threat Hunting. - [KTS7](https://github.com/StamusNetworks/KTS7) - Kibana 7 Templates for Suricata IDPS Threat Hunting. ## Development Tools - [Suricata Language Server](https://github.com/StamusNetworks/suricata-language-server) - An implementation of the Language Server Protocol for Suricata signatures. It adds syntax check, hints and auto-completion to your preferred editor once it is configured. - [suricata-ls-vscode](https://github.com/StamusNetworks/suricata-ls-vscode) - Suricata IntelliSense Extension using the Suricata Language Server. - [suricata-highlight-vscode](https://github.com/dgenzer/suricata-highlight-vscode) - Suricata Rules Support for [Visual Studio Code](/@harrisonqian/awesome/wiki/editors/visual-studio-code) (syntax highlighting, etc). - [SublimeSuricata](https://github.com/ozuriexv/SublimeSuricata) - Basic Suricata syntax highlighter for [Sublime Text](/@harrisonqian/awesome/wiki/editors/sublime-text). - [Suricata-Check](https://suricata-check.teuwen.net/readme.html) - A command-line utility to provide feedback on Suricata rules. It can detect issues such as covering syntax validity, interpretability, rule specificity, rule coverage, and efficiency. ## Documentation and Guides - [SEPTun](https://github.com/pevma/SEPTun) - Suricata Extreme Performance Tuning guide. - [SEPTun-Mark-II](https://github.com/pevma/SEPTun-Mark-II) - Suricata Extreme Performance Tuning guide - Mark II. - [suricata-4-analysts](https://github.com/StamusNetworks/suricata-4-analysts) - The [Security](/@harrisonqian/awesome/wiki/security/security) Analyst's Guide to Suricata. - [Suricata Community Style Guide](https://github.com/sidallocation/suricata-style-guide) - A collaborative document to collect style guidelines from the community of rule writers. ## Analysis Tools - [Suricata Analytics](https://github.com/StamusNetworks/suricata-analytics) - Various resources that are useful when interacting with Suricata data. - [Malcolm](https://github.com/cisagov/Malcolm) - A powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts. - [Evebox](https://github.com/jasonish/evebox) - Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search. ## Rule Sets - [nids-rule-library](https://github.com/klingerko/nids-rule-library#readme) - Collection of various open-source and commercial rulesets. - [Stamus Lateral Movement Detection Rules](https://www.stamus-networks.com/blog/new-open-ruleset-for-detecting-lateral-movement-with-suricata) - Suricata ruleset to detect lateral movement. - [QuadrantSec Suricata Rules](https://github.com/quadrantsec/suricata-rules) - Set of Suricata rules published by QuadrantSec. - [Cluster25/detection](https://github.com/Cluster25/detection) - Cluster25's detection rules. - Networkforensic.dk (NF) rules sets: - [NF IDS rules](https://networkforensic.dk/SNORT/NF-local.zip) - [NF SCADA IDS Rules](https://networkforensic.dk/SNORT/NF-SCADA.zip) - [NF Scanners IDS Rules](https://networkforensic.dk/SNORT/NF-Scanners.zip) - [Quantum Insert detection for Suricata](https://github.com/fox-it/quantuminsert/blob/master/detection/suricata/README.md) - Suricata rules accompanying Fox-IT's QUANTUM 2015 blog/BroCon talk. - [Hunting rules](https://github.com/travisbgreen/hunting-rules) - Suricata IDS alert rules for network anomaly detection from Travis Green. - [3CORESec NIDS - Lateral Movement](https://dtection.io/ruleset/3cs_lateral) - Suricata ruleset focusing on lateral movement techniques (paid). - [3CORESec NIDS - Sinkholes](https://dtection.io/ruleset/3cs_sinkholes) - Suricata ruleset focused on a curated list of public malware sinkholes (free). - [PAW Patrules](https://pawpatrules.fr) - Another free (CC BY-NC-SA) collection of rules for the Suricata engine. - [opnsense-suricata-nmaps](https://github.com/aleksibovellan/opnsense-suricata-nmaps) - OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans. - [Antiphishing](https://github.com/julioliraup/Antiphishing) - Suricata rules and [datasets](/@harrisonqian/awesome/wiki/miscellaneous/datasets) to detect phishing attacks. ## Rule/Security Content Management and Handling - [sidallocation.org](https://sidallocation.org/) - Sid Allocation working group, list of SID ranges. - [Scirius](https://github.com/StamusNetworks/scirius) - Web application for Suricata ruleset management and threat hunting. - [IOCmite](https://github.com/sebdraven/IOCmite) - Tool to create dataset for suricata with indicators of MISP instances and add sightings in MISP if an indicator of dataset generates an alert. - [luaevilbit](https://github.com/regit/luaevilbit) - An Evil bit implementation in luajit for Suricata. - [Lawmaker](https://www.3coresec.com/solutions/lawmaker) - Suricata IDS rule and fleet management system. - [surify-cli](https://github.com/dgenzer/surify-cli) - Generate suricata-rules from collection of IOCs (JSON, CSV or flags) based on your suricata template. - [suricata-prettifier](https://github.com/theY4Kman/suricata-prettifier) - Command-line tool to format and syntax highlight Suricata rules. - [OTX-Suricata](https://github.com/AlienVault-OTX/OTX-Suricata) - Create rules and configuration for Suricata to alert on indicators from an OTX account. - [Aristotle](https://github.com/secureworks/aristotle) - Simple [Python](/@harrisonqian/awesome/wiki/programming-languages/python) program that allows for the filtering and modifying of Suricata and Snort rulesets based on interpreted key-value pairs present in the metadata keyword within each rule. ## Plugins and Extensions - [suricata-zabbix](https://github.com/catenacyber/suricata-zabbix) - Zabbix application layer plugin for Suricata. ## Systems Using Suricata - [SELKS](https://github.com/StamusNetworks/SELKS) - A Suricata-based intrusion detection system/intrusion prevention system/network [security](/@harrisonqian/awesome/wiki/security/security) monitoring distribution. - [Amsterdam](https://github.com/StamusNetworks/Amsterdam) - [Docker](/@harrisonqian/awesome/wiki/back-end-development/docker) based Suricata, Elasticsearch, Logstash, Kibana, Scirius aka SELKS. - [pfSense](https://www.pfsense.org) - A free network firewall distribution, based on the FreeBSD operating system with a custom kernel and including third party [free software](/@harrisonqian/awesome/wiki/miscellaneous/free-software) packages for additional functionality. - [OPNsense](https://opnsense.org) - An open source, easy-to-use and easy-to-build FreeBSD based firewall and routing platform. - [Artica](https://github.com/dtouzeau/artica-suricata) - Suricata IDS [integration](/@harrisonqian/awesome/wiki/platforms/integration) for the [Artica](https://artica.systems) gateway appliance. - [Shovel](https://github.com/FCSC-FR/shovel) - Web interface to explore Suricata EVE outputs, with a primary focus on [network analysis](/@harrisonqian/awesome/wiki/big-data/network-analysis) in CTF competitions. ## Training - [Experimental Suricata Training Environment](https://github.com/jasonish/experimental-suricata-training) - Suricata Training Environment based on [Docker](/@harrisonqian/awesome/wiki/back-end-development/docker)(-Compose). - [CDMCS](https://github.com/ccdcoe/CDMCS/tree/master) - Cyber Defence Monitoring Course: Rule-based Threat Detection. ## Simulation and Testing - [Leonidas](https://github.com/WithSecureLabs/leonidas) - Automated Attack Simulation in the Cloud, complete with detection use cases. - [speeve](https://github.com/satta/speeve) - Fast, probabilistic EVE-[JSON](/@harrisonqian/awesome/wiki/miscellaneous/json) generator for [testing](/@harrisonqian/awesome/wiki/testing/testing) and benchmarking of EVE-consuming applications. - [Dalton](https://github.com/secureworks/dalton) - Suricata and Snort IDS rule and pcap [testing](/@harrisonqian/awesome/wiki/testing/testing) system. ## Data Sets - [suricata-sample-data](https://github.com/FrankHassanabad/suricata-sample-data) - Repository of creating different example suricata data sets. ## Misc - [Suriwire](https://github.com/regit/suriwire) - Wireshark plugin to display Suricata analysis info. - [bash_cata](https://github.com/isMTv/bash_cata) - A simple script that processes the generated Suricata eve-log in real time and, based on alerts, adds an ip-address to the MikroTik Address Lists for a specified time for subsequent blocking. - [suriGUI](https://github.com/control-owl/suriGUI) - GUI for Suricata + Qubes OS. - [SuriGuard](https://github.com/SEc-123/SuriGuard1) - Web-based management system for Suricata IDS/IPS, featuring advanced [analytics](/@harrisonqian/awesome/wiki/miscellaneous/analytics) and visualization capabilities.