Suricata

There are lots of solutions aimed at network security problems, more specifically all the problems around hacks, intrusions, and other types of security breaches that may happen during setup and daily operation. Suricata is one of them: it is free, highly configurable, open source under the GPLv2 license and well optimized, and it is developed by the non-profit Open Information Security Foundation (OISF) for use by security professionals.

Suricata works as an intrusion detection system (IDS), an intrusion prevention system (IPS) and a network security monitoring (NSM) engine, with modules that log events, manage threats and analyze policy violations. The software is fit for handling multi-gigabit traffic loads, with a multi-threaded, scalable code base and hardware acceleration through PF_RING and AF_PACKET on Linux. Once it is configured, protocol detection on any port, logging, HTTP, DNS and TLS recognition and file extraction are done automatically. Suricata has no graphical interface of its own: it is a command-line engine configured through the suricata.yaml file, and its output is usually viewed in third-party tools such as Kibana, Splunk or Logstash-based dashboards.

Suricata gives network defenders a free, high-performance engine for intrusion detection, intrusion prevention and network security monitoring.

Features:

• Built-in logging output, with the EVE JSON event and alert format for integration with third-party tools
• NSM data: protocol information, flows and HTTP, DNS and TLS logs record the precise data needed
• A complete signature language to match known threats, policy violations, anomalies in data traffic and malicious behavior patterns
• Lua scripting for complex detection scenarios, to extend the analysis capabilities of the program and detect extra information
• Configuration options, such as threading and capture settings, to tune the engine to your hardware and current traffic

That covers the main points, though not everything that comes with Suricata. It also supports file extraction and PCAP capture for later investigation. It is not a tool for beginners: setting up the engine, its rule sets and network capture takes precision and knowledge, and a poor configuration can lead to missed alerts or dropped traffic. On Windows it is installed from a 64-bit MSI package and needs Npcap for live capture; it also runs on Linux, macOS and FreeBSD. For experienced users it is a strong choice among network security engines.