Features
IDS and IPS
Suricata provides threat detection capabilities. In IDS mode, it is going to analyse the traffic and generate an alert when a signature matches.
In IPS mode, it acts like a firewall. It provides traffic filtering and monitoring and allows network administrators to write and enforce detection rules. [5]
Suricata is able to detect common attack vectors such as port scanning, denial-of-service, pass-the-hash, and brute-force attacks. [5]
Network monitoring
Suricata can be used to monitor network traffic in real time. It can log various types of network transactions, including HTTP, DNS, SMB and TLS sessions.
Suricata can extract files from network traffic to disk for further analysis. It supports extraction over protocols such as FTP, HTTP, SMTP and SMB. It can also perform file type identification or hash computation of the files seen on the network without extracting them to disk.
PCAP logging
Suricata can log network traffic in PCAP format for later analysis with tools such as Wireshark. It also supports conditional pcap logging where only the traffic of flow where a rule matched is logged.
Suricata logs events in the JSON format, which can be easily parsed and analyzed by other tools.
This page is based on this
Wikipedia article Text is available under the
CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.
