awesome-suricata

Suricata ruleset focusing on lateral movement techniques (paid).

Suricata ruleset focused on a curated list of public malware sinkholes (free).

Suricata rules and datasets to detect phishing attacks.

Cluster25's detection rules.

Suricata IDS alert rules for network anomaly detection from Travis Green.

Docker based Suricata, Elasticsearch, Logstash, Kibana, Scirius aka SELKS.

Suricata IDS integration for the

An open source, easy-to-use and easy-to-build FreeBSD based firewall and routing platform.

A free network firewall distribution, based on the FreeBSD operating system with a custom kernel and including third party free software packages for additional functionality.

A Suricata-based intrusion detection system/intrusion prevention system/network security monitoring distribution.

Web interface to explore Suricata EVE outputs, with a primary focus on network analysis in CTF competitions.

Suricata Ansible role (slightly outdated).

Suricata Docker image.

Input Plugin for Telegraf to collect and forward Suricata

Mass deploy and update Suricata IDPS using Ansible IT automation platform.

Simple Probing Tool for Corporate Walled Garden Networks.

Automatic enumeration and maintenance of Suricata monitoring interfaces.

Simple Python program that allows for the filtering and modifying of Suricata and Snort rulesets based on interpreted key-value pairs present in the metadata keyword within each rule.

Tool to create dataset for suricata with indicators of MISP instances and add sightings in MISP if an indicator of dataset generates an alert.

Suricata IDS rule and fleet management system.

An Evil bit implementation in luajit for Suricata.

Create rules and configuration for Suricata to alert on indicators from an OTX account.

Web application for Suricata ruleset management and threat hunting.

A simple script that processes the generated Suricata eve-log in real time and, based on alerts, adds an ip-address to the MikroTik Address Lists for a specified time for subsequent blocking.

Web-based management system for Suricata IDS/IPS, featuring advanced analytics and visualization capabilities.

GUI for Suricata + Qubes OS.

Wireshark plugin to display Suricata analysis info.

Cyber Defence Monitoring Course: Rule-based Threat Detection.

Suricata Training Environment based on Docker(-Compose).

Suricata and Snort IDS rule and pcap testing system.

Automated Attack Simulation in the Cloud, complete with detection use cases.

Fast, probabilistic EVE-JSON generator for testing and benchmarking of EVE-consuming applications.

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search.

A powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Various resources that are useful when interacting with Suricata data.