Rule-based network intrusion prevention system
The next generation of the Snort IPS, maintained by Cisco Talos: multi-threaded, with a new rule parser and Lua-based configuration.
Snort is one of the oldest and best-known network intrusion detection and prevention systems. Snort 3 is a redesign with multiple packet-processing threads, a pluggable architecture, Lua configuration and an updated rule syntax.
Rule sets are published by Cisco Talos (community, registered and subscriber tiers). Snort can run passively as an IDS or inline as an IPS.
GPL-2.0-only · GNU GPL v2 · Open source
GitHub does not detect the licence; the LICENSE file contains the GPL v2 text.
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION.
No published advisory found for Snort 3 in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
Network security monitoring and traffic analysis framework
Network analysis framework, formerly Bro, that turns traffic into rich, structured logs of connections and protocols, with its own scripting language.
Network IDS, IPS and security monitoring engine
High-performance network threat detection engine from the OISF: signature-based IDS/IPS, protocol logging and file extraction in one multi-threaded engine.
Platform for threat hunting and security monitoring
Linux distribution and platform for network security monitoring, log management and threat hunting that bundles Suricata, Zeek and Elastic components.
Collaborative behaviour-based IPS
Security engine that parses logs to detect aggressive behaviour, blocks it with remediation components and shares signals in a community blocklist.
Network protocol analyser
The widely used network protocol analyser: capture live traffic or open capture files and inspect thousands of protocols with display filters.
