Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Repository Index
47,133 repositories indexed
1–24 of 27 · Most stars
A Suricata based NDR distribution
Tenzir is the data pipeline engine for security teams.
Scirius is a web application for Suricata ruleset management and threat hunting.
Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
A Suricata Docker image.
gonids is a library to parse IDS rules, with a focus primarily on Suricata rule compatibility. There is a discussion forum available that you can join on Google Groups: https://groups.google.com/forum/#!topic/gonids/
Suricata rules for network anomaly detection
Cyber Defence Monitoring Course Suite :: Suricata, Arkime (and others in the past)
Web interface to explore Suricata EVE outputs
OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans
RDP honeypot
fast, extensible, versatile event router for Suricata's EVE-JSON format
Advanced Phishing Protection: Suricata rulesets open and free
Repository of creating different example suricata data sets
Suricata rule and intel index
A Prometheus Exporter for Suricata
provides a Suricata Eve output for Kafka with Suricate Eve plugin
Local-LLM alert triage for self-hosted SOCs.
Syntax highlighting for suricata rules
Go Client for Suricata (Interacting via Socket)
Command-line tool to format and syntax highlight Suricata rules
automatic enumeration and maintenance of Suricata monitoring interfaces