Network IDS, IPS and security monitoring engine
High-performance network threat detection engine from the OISF: signature-based IDS/IPS, protocol logging and file extraction in one multi-threaded engine.
Suricata inspects network traffic against rule sets (compatible with the widely used ET Open and commercial rules) and can run inline as an IPS. Beyond alerts, it produces detailed protocol logs (HTTP, TLS, DNS and more) in its EVE JSON format, which many SIEMs ingest directly.
It is developed by the Open Information Security Foundation (OISF), a non-profit, and is embedded in several other open-source platforms, including Security Onion and firewall distributions.
GPL-2.0-only · GNU GPL v2 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: GPL-2.0.
151 published advisories for Suricata in GitHub repository advisories; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.
GHSA-r3hp-j746-q2qcmedium2026-09-29
pgsql: crafted responses can corrupt EVE JSON logs
GHSA-2749-6qq4-fmmxlow2026-09-29
rdp: malformed MCS/CS lengths can stall per-flow RDP inspection
GHSA-83v2-4j73-5fv8medium2026-09-29
ftp: overlong control lines can bypass inspection of following lines
GHSA-c7mw-7vrp-cxh2low2026-09-29
pgsql: inconsistent row field counts can disable response inspection
GHSA-g643-4v67-43w4medium2026-09-29
lua/hashlib: callable garbage collector can cause a use-after-free
GHSA-7mqh-xj44-f8j5low2026-09-29
ssh: oversized KEXINIT can desynchronize hassh inspection
GHSA-pr5g-4m3f-p6m2high2026-09-29
threshold: decision cache can grow without bound and terminate Suricata
GHSA-hcq7-vc86-78cjhigh2026-09-29
http: brotli compression bomb can exhaust memory
GHSA-cjp4-cqmq-hp42low2026-09-29
ldap: TCP gap resynchronization failure can disable per-flow inspection
GHSA-8r7m-7827-hvf7medium2026-09-29
ike: malformed IKEv1 traffic can bypass app-layer error policy
GHSA-4q65-xhr9-rh6glow2026-09-29
swf: attacker-controlled FileLength truncates decompressed inspection, evading file rules
GHSA-93vw-3m29-vx6xlow2026-09-29
dnp3: framing errors can stop transaction inspection for a flow
Sources: GitHub repository advisories · checked 2026-10-20.
Network security monitoring and traffic analysis framework
Network analysis framework, formerly Bro, that turns traffic into rich, structured logs of connections and protocols, with its own scripting language.
Rule-based network intrusion prevention system
The next generation of the Snort IPS, maintained by Cisco Talos: multi-threaded, with a new rule parser and Lua-based configuration.
Platform for threat hunting and security monitoring
Linux distribution and platform for network security monitoring, log management and threat hunting that bundles Suricata, Zeek and Elastic components.
Collaborative behaviour-based IPS
Security engine that parses logs to detect aggressive behaviour, blocks it with remediation components and shares signals in a community blocklist.
Network protocol analyser
The widely used network protocol analyser: capture live traffic or open capture files and inspect thousands of protocols with display filters.
