Suricata IDS

suricata -c suricata.yaml -i <if>

Run Suricata as an IDS on an interface, applying detection rules to traffic in real time and generating alerts.

Run it when you want real-time network detection: Suricata applies the rules (ET Open/Pro, your own, or community ones) to the interface traffic and generates alerts with the attack details — exploits, scans, malware, C2. It's the reference open-source IDS, with multi-threading (unlike Snort) and the ability to also do IPS (NFQUEUE) and file capture. In the SOC, it's the network detection layer that complements the EDR: traffic the endpoint doesn't see (or that the attacker directs to other hosts) alerts here. The configuration (suricata.yaml) defines the interfaces, rules, and output (eve.json for the SIEM).

Don't deploy it without calibration: the default rules (ET Open) generate constant alerts on networks with legitimate traffic — without tuning, the noise kills the signal and the team ignores the alerts. Performance: on busy interfaces (more than ~1Gbps on modest hardware), Suricata falls behind and starts dropping packets — measure capacity before trusting it. And watch out: the IDS sees traffic, not encrypted content: C2 over HTTPS without decryption doesn't generate content alerts (only connection ones); decryption (or metadata analysis) is another layer. Poorly written custom rules (inefficient regex) degrade performance — validate each rule in test mode before activating it.