Suricata

Suricata is an open source network threat detection engine that inspects traffic as it flows, matches it against thousands of rules and logs what it sees along the way. It is developed by the Open Information Security Foundation, or OISF, a US non-profit funded by security companies. The source code is released under the GPL v2.

Work on the engine began in November 2007, when Victor Julien and Matt Jonkman wrote the first code. A public beta appeared at the end of 2009, and both version 1.0 and the foundation followed in 2010, helped by initial funding from the US Department of Homeland Security. The 8.x branch, first released in July 2025, has now reached version 8.0.7, published on 15 September 2026.

What Suricata is for

Suricata does three jobs. As an IDS it watches a copy of the traffic and raises an alert whenever a packet matches a signature. As an IPS it sits inline in the packet path and can drop whatever breaks the rules. As a network security monitoring tool it records metadata about every exchange, alert or not, including DNS queries, HTTP transactions, TLS certificates and transferred files.

The engine is multi-threaded, which according to the project website lets a single instance inspect multi-gigabit traffic. It identifies protocols automatically regardless of port, so a web server hiding on an unusual port is still parsed as HTTP. Rules follow the long-established Snort syntax, and the default setup offers the free Emerging Threats ruleset. All output lands in EVE, a JSON log designed to be shipped to Elasticsearch or Splunk.

Version 8 introduced an experimental firewall mode in which nothing passes unless a rule allows it, and added protocols such as LDAP, POP3, WebSocket and DNS over HTTPS. Much of the protocol parsing code has also been rewritten in Rust.

In our software library Suricata sits next to Zeek, and the two are easily confused. Zeek concentrates on rich logs and a full scripting language, while Suricata remains first and foremost a signature engine that can also block. Wazuh works on endpoints and servers, Falco watches system calls inside containers, and ntopng measures traffic volumes rather than threats.

Who is it for?

Suricata is built for security operations centre analysts, administrators protecting a corporate or campus network, incident responders replaying PCAP captures after a breach, and vendors embedding it in firewalls or sensors.

It does demand real expertise. The suricata.yaml file holds hundreds of settings, and a poorly tuned ruleset quickly buries analysts in false positives. There is no graphical interface, so viewing alerts means plugging in an external dashboard. On a busy link it needs plenty of CPU cores and memory, sometimes a specialised capture card as well. It also sees nothing of encrypted payloads beyond TLS metadata, and it does not monitor activity inside the machines themselves, which is where Wazuh or Falco come in.

Download Suricata safely

Official releases are collected on the Download page at suricata.io. It offers the source tarball with its PGP signature, a 64-bit MSI installer for Windows and pointers to Linux packages, namely the OISF PPA for Ubuntu, COPR repositories for the Red Hat family and Debian backports. On macOS and FreeBSD you build from source. Live capture on Windows also requires the Npcap driver.

The engine is free for everyone. The only thing OISF sells is a non-GPL licence for its Platinum and Gold members. The 7.x branch reached end of life in July 2026, and according to the OISF announcement version 8.0.7 alone fixes 67 security issues. A sensor exposed to hostile traffic should therefore never run an outdated or repackaged build picked up from a third-party site.

Frequently asked questions