OISF/suricata

Features

• Traffic Capture Frameworks - Captures raw network packets from live interfaces or offline pcap files for real-time analysis.
• Network Intrusion Detection - An open-source engine that analyzes network traffic in real-time to detect and alert on malicious activity using signature-based rules.
• HTTP URI Component Inspectors - Matches individual parts of the HTTP URI, such as path, query string, or hostname, for threat detection.
• Inline Rule Scripts - Ships a Lua scripting extension system that allows custom detection logic to be embedded directly in rules.
• Lua Rule Extensions - Combines Lua scripts with standard rule keywords to add custom inspection logic to a rule.
• In-Transit File Inspectors - Examines files transferred over network protocols against stored rules to detect malicious payloads or policy violations.
• Threat Detection Rule Repositories - Downloads, enables, and maintains rule sets from external sources to keep threat detection current.
• Inline Traffic Blockers - Places the engine directly in the network path to drop or reject packets that match detection rules.
• Flow Tracking Engines - Maintains per-flow state tables across multiple packets for context-aware intrusion detection and protocol analysis.
• Network Flow Analyzers - Inspects and tracks network conversations to detect patterns and anomalies across multiple packets.
• IP Address Filters - Matches network traffic against specific IP addresses or address ranges to filter or trigger detection rules.
• HTTP Response Body Inspectors - Analyzes HTTP response body content against detection rules to identify malicious payloads or data leaks.
• Network Traffic Analyzers - Inspects every packet crossing the network boundary and applies a set of rules to detect malicious or anomalous activity as it happens.
• Dataset Lookups - Matches network traffic against named datasets of IPs, domains, or other data to trigger rules on hits.
• Lua Packet Field Extractors - Extracts specific bytes or fields from a packet payload using Lua code for further analysis.
• High-Performance Capture Engines - Captures network packets using specialized hardware and kernel-bypass techniques for high-speed traffic analysis.
• Multi-Interface - Reads network traffic directly from hardware interfaces or PCAP files for analysis in both inline and passive modes.
• Traffic Interception - Intercepts and blocks malicious traffic as it passes through the network, preventing threats from reaching their target.
• Traffic Protocol Inspection - Parses and inspects application-layer protocols including HTTP, DNS, TLS, SMB, and MQTT for protocol-specific attacks.
• Application-Layer Protocol Inspections - Parses and analyzes traffic for protocols such as HTTP, DNS, TLS, SMB, and many others to detect protocol-specific attacks.
• Detection Rule Scripting Extensions - Embeds Lua scripts directly in detection rules and output modules to extend logic without recompiling the core engine.
• HTTP Response Header Inspectors - Matches HTTP response header fields against detection rules to identify suspicious server behavior or content.
• Custom Detection Rules - Provides a framework for writing and integrating user-defined detection rules and Lua scripts to identify specific threats or anomalies.
• Lua Detection Rules - Writes detection rules using Lua scripting to inspect packet payloads and match custom patterns.
• Intrusion Prevention Systems - Places the engine inline on network paths to drop or reject malicious packets in real-time.
• Inline Blocking Modes - Injects drop decisions inline with traffic flow to actively block malicious packets before they reach the target.
• IP Reputation Scoring - Checks source and destination IP addresses against a user-defined blacklist or whitelist to classify traffic as trusted or malicious.
• Network Security - Analyzes network packets in real-time to detect and block malicious activity, protecting infrastructure from threats.
• Network Security Configuration - Configures operational parameters including network interfaces, logging, and rule paths for intrusion detection.
• Network Security Monitors - Provides real-time network traffic analysis and alerting on suspicious events using signature-based detection rules.
• Signature-Based Threat Detectors - Matches network traffic against user-defined signatures and datasets to identify known attack patterns and policy violations.
• TLS Inspection Tools - Examines TLS handshake attributes like version, cipher suite, and SNI to detect anomalies or policy violations.
• SMTP Traffic Inspections - Examines email messages for malicious attachments, phishing attempts, and spam patterns.
• Rule-Based Pattern Matching - Matches network traffic against user-defined rules using protocol fields, content patterns, and flow state.
• Inline Traffic Blockers - Inspects network packets against rules and drops or rejects those that match a threat signature to block malicious traffic.
• Inline Traffic Blockers - Stops malicious packets from reaching their destination by dropping or rejecting them inline based on rule matches.
• Network Traffic Monitors - Analyzes network packets in real-time to detect and alert on suspicious activity or policy violations.
• HTTP Request Body Inspectors - Inspects HTTP request body content against detection rules to identify malicious payloads and policy violations.
• PCAP File Readers - Reads network traffic from PCAP files for offline analysis and replay of captured packets.
• HTTP Request Header Inspectors - Matches HTTP request header fields against detection rules to identify malicious or anomalous traffic patterns.
• File Extraction Tools - Reassembles and saves files transferred over monitored protocols for offline analysis and malware inspection.
• SSH Anomaly Detectors - Inspects SSH protocol fields to detect brute-force attacks and other malicious activity through anomaly detection.
• Output Scripts - Runs custom Lua scripts to format and output alert data, enabling flexible log processing without recompiling.
• Rule Management Tools - Provides command-line utilities for updating, enabling, and disabling detection rulesets.
• Honeypot File Transfer Capturers - Captures and stores files transmitted across the network for offline analysis or evidence collection.
• Multi-Stage Analysis Pipelines - Processes packets through sequential capture, decode, detection, and output stages in a fixed pipeline.
• Runtime Dataset Updaters - Adds or removes entries in a dataset at runtime using rule actions, keeping the set current without reloading.
• Embedded Detection Engines - Ships a shared library API that allows embedding the full detection engine inside custom applications.
• Email Threat Inspections - Scans email header fields and attachments against rule conditions to detect malicious content or policy violations.
• Cross-Flow State Trackers - Stores a named boolean flag that persists across multiple network flows and can be queried or set by later rules.
• Network Traffic Transformers - Applies transformations to network traffic data to normalize or modify it for analysis.
• Traffic Bypass Rules - Skips processing of packets that match a configured rule, reducing load on the detection engine.
• Capture Driver Parameter Tuning - Adjusts driver-level parameters like ring buffer size and promiscuous mode for optimal packet capture performance.
• AF_PACKET Capture Engines - Captures network packets directly from a Linux AF_PACKET socket for high-performance inline intrusion detection and prevention.
• Hardware Offloads - Delegates packet acquisition to specialized network interface cards to reduce CPU load and improve capture performance.
• AF_XDP Capture Engines - Captures network packets using the AF_XDP socket interface for high-performance, zero-copy packet processing.
• Myricom - Captures network packets using Myricom network adapters for high-speed packet capture, bypassing standard kernel interfaces.
• Attack Detectors - Inspects RFB protocol fields and traffic patterns to identify malicious VNC connections and exploitation attempts.
• Runtime Control Sockets - Accepts JSON commands over a Unix socket to manage rules, retrieve statistics, and control packet processing at runtime.
• Prefilter Keywords - Applies prefiltering keywords to rules so packets are evaluated before full rule processing, improving detection speed.
• VLAN Traffic Inspectors - Matches network packets based on their VLAN identifier to filter or analyze traffic within specific virtual LAN segments.
• eBPF Traffic Analyzers - Attaches eBPF and XDP programs to network interfaces to filter and process packets before they reach the kernel's network stack.
• Runtime Rule Reloads - Applies updated rule sets to a running engine without stopping or restarting the active process.
• Network Capture Offload Layers - Provides a hardware offload abstraction layer that delegates packet capture and pattern matching to supported NICs.
• Unix Socket Interfaces - Exposes a Unix domain socket control interface for external processes to manage rules and retrieve statistics.
• Scriptable Detection Engines - Extends detection and output logic by executing custom Lua scripts from rules and output modules.
• Traffic Isolation - Separates network traffic into distinct tenant contexts so rules and configurations apply only to the designated segment.
• TLS Certificate Field Validators - Checks SSL/TLS certificate fields such as issuer, subject, and validity against defined patterns to enforce security policies.
• Rule Exception Definitions - Defines custom actions for packets that trigger rule violations, overriding default drop or alert behavior.
• TLS Fingerprinting - Computes a hash of TLS handshake parameters to identify the client or server software making the connection.
• Kerberos Anomaly Detectors - Matches network traffic against Kerberos-specific fields to identify suspicious authentication activity.
• WebSocket Traffic Inspections - Inspects WebSocket traffic for malicious patterns and enforces security policies on WebSocket communications.
• YAML Configuration Files - Defines engine behavior in a hierarchical YAML file that supports modular includes for rules and settings.
• Event Logging - Outputs network events as structured JSON records for ingestion by log management and analytics platforms.
• Structured JSON Loggers - Outputs detection alerts and other events as JSON records for integration with external log management and analysis tools.
• Detection Pipeline Module Extenders - Adds new protocol parsers and inspectors by writing C modules that plug into the engine's event pipeline.
• Alert Thresholds - Limits the number of times a specific alert can fire within a set time window to reduce noise and prevent alert fatigue.
• Protocol Anomaly Detectors - Inspects application-layer protocols like HTTP, TLS, and SSH for malformed packets or suspicious behavior.
• CIP - Inspects ENIP/CIP traffic for malformed or malicious packets using protocol-specific keywords to identify attacks.
• NTP Anomaly Detectors - Inspects NTP traffic for malformed packets, invalid timestamps, and other protocol-level violations to identify attacks.
• Rule Frequency Limiters - Applies a global threshold to cap how many times a specific detection rule can trigger within a set time window.
• Network Forensic Extractions - Captures and stores files transferred over network protocols for offline analysis and evidence collection.
• mDNS Traffic Inspectors - Inspects multicast DNS protocol fields to detect anomalies or threats in local network service discovery.
• Runtime Service Controllers - Controls a running engine by sending commands to reload rules, manage logging, and check status.
• HTTP Method and Version Inspectors - Matches the HTTP method and protocol version to enforce allowed usage or detect anomalies.
• Security & Privacy - Network threat detection engine.

Star history