#suricata — Public Fediverse posts

Great news! We’ve been invited to do a 4 hour workshop training for Security BSides Las Vegas 2026!

Join us for “Engineering the Hunt: Developing AI SKILLs for Network Security Monitoring” with Peter Manev, Jeff Lucovsky & Lukas Sismis on August 3rd at 3pm PST.

Learn more: bsideslv.org

#Suricata #BSidesLasVegas

Great news! We’ve been invited to do a 4 hour workshop training for Security BSides Las Vegas 2026!

Join us for “Engineering the Hunt: Developing AI SKILLs for Network Security Monitoring” with Peter Manev, Jeff Lucovsky & Lukas Sismis on August 3rd at 3pm PST.

Learn more: bsideslv.org

#Suricata #BSidesLasVegas

Let’s give it up for the sponsors making #SuriCon2026 possible: OPNsense, Léargas Security, Corelight, Stamus Networks, ENEA, Catena Cyber, NEOX, Nomic Networks, and AWS.

Sponsorship opportunities are still available! Help bring this community together in 2026! suricon.net/sponsorships/

#Suricata #SuriCon #Sponsors

Let’s give it up for the sponsors making #SuriCon2026 possible: OPNsense, Léargas Security, Corelight, Stamus Networks, ENEA, Catena Cyber, NEOX, Nomic Networks, and AWS.

Sponsorship opportunities are still available! Help bring this community together in 2026! suricon.net/sponsorships/

#Suricata #SuriCon #Sponsors

I seem to be seeing that the #ip #ipv4 addresses of some legit #reticulum #nodes are being included in some of the lists used by #suricata #IDS #intrustiondetectionsystem to #blacklist IP addresses, and so they might well end up blocked by your #firewall or #IPS #intrusionprotectionsystem
in particular e.g. database #CINS might be flagging mesh nodes
Please take steps for port 4242
#port4242 normally used by #rns #reticulum to not let bad data spoil the #mesh #nomadnet #meshchat #meshchatx

I seem to be seeing that the #ip #ipv4 addresses of some legit #reticulum #nodes are being included in some of the lists used by #suricata #IDS #intrustiondetectionsystem to #blacklist IP addresses, and so they might well end up blocked by your #firewall or #IPS #intrusionprotectionsystem
in particular e.g. database #CINS might be flagging mesh nodes
Please take steps for port 4242
#port4242 normally used by #rns #reticulum to not let bad data spoil the #mesh #nomadnet #meshchat #meshchatx

EveBox can now process PCAP files directly and take care of processing with #Suricata for you. Only on Linux right now. But I plan to fix that.

EveBox can now process PCAP files directly and take care of processing with #Suricata for you. Only on Linux right now. But I plan to fix that.

Using #suricata #IDS and #abuseipdb with manual checks using #claudecode to identify IP addresses that are attacking my reverse proxy device. I block in #nftables the IPs that tick all three boxes:
1. suricata reports attack,
2. claude code investigates and confirms attack (and we log the CVE etc.), and
3. IP is already high confidence bad actor.
A bit slow really due to manual checking. How does one extend to #IPv6 ? What measures should one add? #portscanning

Using #suricata #IDS and #abuseipdb with manual checks using #claudecode to identify IP addresses that are attacking my reverse proxy device. I block in #nftables the IPs that tick all three boxes:
1. suricata reports attack,
2. claude code investigates and confirms attack (and we log the CVE etc.), and
3. IP is already high confidence bad actor.
A bit slow really due to manual checking. How does one extend to #IPv6 ? What measures should one add? #portscanning

SuriCon is community-funded - sponsorships keep it self-sustaining.

Spots remain from the $800 Mob tier (for individual super fans) up to Community Partner ($10K).

And our last exclusive slot: Welcome Reception Sponsor ($6K).

Secure your spot: suricon.net/sponsorships/

#Suricata #SuriCon #SuriCon2026

SuriCon is community-funded - sponsorships keep it self-sustaining.

Spots remain from the $800 Mob tier (for individual super fans) up to Community Partner ($10K).

And our last exclusive slot: Welcome Reception Sponsor ($6K).

Secure your spot: suricon.net/sponsorships/

#Suricata #SuriCon #SuriCon2026

Got tired of mucking with these miserable #screenconnect msi's so here's a #suricata rule to catch the initial check via sni:

https://gist.github.com/silence-is-best/29afec335264313e9bf5bfa1c6e60144

https://app.any.run/tasks/73887f39-a8ac-4702-a67d-36465caca294
cc @da_667

Got tired of mucking with these miserable #screenconnect msi's so here's a #suricata rule to catch the initial check via sni:

https://gist.github.com/silence-is-best/29afec335264313e9bf5bfa1c6e60144

https://app.any.run/tasks/73887f39-a8ac-4702-a67d-36465caca294
cc @da_667

The Hunters Ledger ruleset was recently added to the #Suricata ruleset index; check it out here: https://the-hunters-ledger.com/

Thank you Joseph Harrison (https://www.linkedin.com/in/josephrharrison/)

The Hunters Ledger ruleset was recently added to the #Suricata ruleset index; check it out here: https://the-hunters-ledger.com/

Thank you Joseph Harrison (https://www.linkedin.com/in/josephrharrison/)

Suricata produces rich network telemetry, alerts, anomalies, flow data, DNS, TLS, SSH, Kerberos, and more, but raw EVE JSON isn't investigation ready on its own.

The Suricata IDS/IPS Content Pack for Graylog parses, enriches, and maps that data to the Graylog Information Model, with a dashboard built in. Setup covers Filebeat via Sidecar or syslog forwarding.
Full breakdown here: https://graylog.org/post/suricata-ids-ips-data-in-graylog/
#Graylog #Suricata #SIEM #ThreatHunting #InfoSec #NetworkSecurity

Suricata produces rich network telemetry, alerts, anomalies, flow data, DNS, TLS, SSH, Kerberos, and more, but raw EVE JSON isn't investigation ready on its own.

The Suricata IDS/IPS Content Pack for Graylog parses, enriches, and maps that data to the Graylog Information Model, with a dashboard built in. Setup covers Filebeat via Sidecar or syslog forwarding.
Full breakdown here: https://graylog.org/post/suricata-ids-ips-data-in-graylog/
#Graylog #Suricata #SIEM #ThreatHunting #InfoSec #NetworkSecurity

We're pleased to announce the releases of #Suricata 8.0.6 and 7.0.17! 🎉
With this, Suricata 7 series has reached its #EOL.

See the release notes at https://forum.suricata.io/t/suricata-8-0-6-and-7-0-17-released/6391/1

We're pleased to announce the releases of #Suricata 8.0.6 and 7.0.17! 🎉
With this, Suricata 7 series has reached its #EOL.

See the release notes at https://forum.suricata.io/t/suricata-8-0-6-and-7-0-17-released/6391/1

Are you using #wazuh and want to integrate threat intelligence today? These two posts might interest you:

https://blog.federicofantini.net/blog/2026/03/23/Wazuh-Threat-Intelligence.html

https://blog.federicofantini.net/blog/2026/06/24/Extending-Wazuh-Threat-Intelligence-with-OpenCTI.html

#wazuh #opencti #homelab #sysmon #suricata #threatintel #retrohunting

RE: https://infosec.exchange/@suricata/116844873558861550

These are cute. And cool.

And the different messages that they represent and embrace are part of why I truly love #suricata project and community.

Future Suricata contributors start small. These little shirts are a playful community moment, but this is how open source lasts. It stays useful today while remaining open to the people who will shape what comes next.

Some future contributors are still growing into the shirt 🧸

#Suricata

Future Suricata contributors start small. These little shirts are a playful community moment, but this is how open source lasts. It stays useful today while remaining open to the people who will shape what comes next.

Some future contributors are still growing into the shirt 🧸

#Suricata

#Suricata powers many of today’s leading network detection and response solutions, including Clear NDR Community, which is widely used by practitioners to explore what is possible with Suricata IDS/IPS/NSM and the network protocol monitoring logs and alerts it produces.

#IDS #IPS #NSM

#Suricata powers many of today’s leading network detection and response solutions, including Clear NDR Community, which is widely used by practitioners to explore what is possible with Suricata IDS/IPS/NSM and the network protocol monitoring logs and alerts it produces.

#IDS #IPS #NSM

Heading to BSides Porto?

Be sure to connect with
@jufajardini . She’ll be there representing Suricata on Saturday.

Find her and chat about open source security, and don’t forget to ask her for some Suricata swag.

bsidesporto.org

#Suricata #BSidesPorto #OpenSource #Cybersecurity

Heading to BSides Porto?

Be sure to connect with
@jufajardini . She’ll be there representing Suricata on Saturday.

Find her and chat about open source security, and don’t forget to ask her for some Suricata swag.

bsidesporto.org

#Suricata #BSidesPorto #OpenSource #Cybersecurity

Major releases take time. They evolve through development, testing, review, feedback, and real deployment needs.

If you use #Suricata today, what should be improved or carried forward toward Suricata 9?

Share your thoughts now, or bring them to #SuriCon .

Major releases take time. They evolve through development, testing, review, feedback, and real deployment needs.

If you use #Suricata today, what should be improved or carried forward toward Suricata 9?

Share your thoughts now, or bring them to #SuriCon .

🚀 SO-CRATES 1.1 is here — now with Light Mode! ☀️

The tool you loved as OhMyPCAP keeps getting better.

Your all-in-one Docker/Podman container for rapid analysis of PCAPs, logs, and binaries just leveled up.

✅ PCAPs → Suricata alerts, rich metadata, ASCII transcripts, stream carving
✅ Logs → Sigma alerts + originals
✅ Binaries → YARA matches + metadata

Perfect for air-gapped environments, malware analysis, IR, threat hunting, forensics & teaching.

What’s your preference?
→ Dark Mode 🖤
→ Light Mode ☀️
→ Why not both?
→ Needs glorious 4-color CGA option lol
Comment below!

#DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma #DarkMode #LightMode

Как работает эта ваша суриката 3 часть

Третья часть цикла статей по разбору устройства работы IDS/IPS решения Suricata. Разберём на практике уязвимость CVE‑2025‑66698 – обход аутентификации в Veda (Semantic Machines) v5.4.8. Запишем трафик с вредоносными запросами и составим suricata-правило, которое детектирует эксплуатацию уязвимости. В статье также приводятся объяснения как работают content, pcre и липкие буферы.

https://habr.com/ru/articles/1049776/

#suricata #dalton #wireshark #безопасность_сети #dpi #ids

Two opportunities to learn more on Suricata this August, at BlackHat.

For those who learn best through real traffic, rules, tuning, and workflow questions, this is one to keep on the radar. Suricata’s value is clearest when you can see it in practice.

August 5: https://blackhat.com/us-26/arsenal/schedule/#suricata-8-discover-the-difference-in-network-detection-52685

August 6: https://blackhat.com/us-26/arsenal/schedule/#suricata-turbo-let-your-nic-drop-the-flows-suricata-wont-miss-51975

#Suricata #BlackHatUSA2026

Two opportunities to learn more on Suricata this August, at BlackHat.

For those who learn best through real traffic, rules, tuning, and workflow questions, this is one to keep on the radar. Suricata’s value is clearest when you can see it in practice.

August 5: https://blackhat.com/us-26/arsenal/schedule/#suricata-8-discover-the-difference-in-network-detection-52685

August 6: https://blackhat.com/us-26/arsenal/schedule/#suricata-turbo-let-your-nic-drop-the-flows-suricata-wont-miss-51975

#Suricata #BlackHatUSA2026

New in Suricata 9 and available in main, the `subslice` transform keyword creates a bounded window from a sticky buffer before content matching.

Jeff Lucovsky covers how it works, with URI-ending, header-skipping, and short User-Agent examples.

https://suricata.io/2026/06/16/suricata-keyword-highlight-subslice-part-1/

#SuricataTips #Suricata

New in Suricata 9 and available in main, the `subslice` transform keyword creates a bounded window from a sticky buffer before content matching.

Jeff Lucovsky covers how it works, with URI-ending, header-skipping, and short User-Agent examples.

https://suricata.io/2026/06/16/suricata-keyword-highlight-subslice-part-1/

#SuricataTips #Suricata

SuriCon 2026 is taking shape in Lisbon.

Sponsor support helps make the event possible. Thank you to OPNsense, Léargas Security, Stamus Networks, AWS, and Corelight for helping create space for training, technical conversations, and community work.

Become a sponsor: suricon.net/sponsorships/

#Suricata #SuriCon2026 #Sponsors

SuriCon 2026 is taking shape in Lisbon.

Sponsor support helps make the event possible. Thank you to OPNsense, Léargas Security, Stamus Networks, AWS, and Corelight for helping create space for training, technical conversations, and community work.

Become a sponsor: suricon.net/sponsorships/

#Suricata #SuriCon2026 #Sponsors

Как работает эта ваша суриката 2 часть

Вторая часть цикла статей о практическом применении Suricata IDS/IPS. Рассмотрим базовые модификаторы Suricata на примерах DNS-запросов и на сетевых атаках. Уделим внимание механизму threshold для предотвращения флуда алертов.

https://habr.com/ru/articles/1047804/

#suricata #dalton #безопасность_сети #ids #dpi

Как работает эта ваша суриката

Всем привет! Моя работа связана с анализом сетевого трафика и написанием детектирующих правил Suricata. Я хочу поделиться с вами опытом работы с данным инструментом. Разберёмся в тонкостях работы этого ids/ips решения, научимся писать сигнатурные правила, а также понимать, как их писать для выявления нелегитимной активности.

https://habr.com/ru/articles/1047246/

#suricata #dalton #безопасность_сети

Corelight is joining SuriCon 2026 as a Community Partners sponsor.

Suricata often sits where network visibility, detection, and investigation meet. Corelight connects to that work by bringing Suricata IDS alerts together with Zeek network evidence.

Learn more: corelight.com

#Suricata #SuriCon2026

Corelight is joining SuriCon 2026 as a Community Partners sponsor.

Suricata often sits where network visibility, detection, and investigation meet. Corelight connects to that work by bringing Suricata IDS alerts together with Zeek network evidence.

Learn more: corelight.com

#Suricata #SuriCon2026

Suricata 8.0.5 out in ArchLinux AUR:
https://aur.archlinux.org/packages/suricata
#suricata

Suricata 8.0.5 out in ArchLinux AUR:
https://aur.archlinux.org/packages/suricata
#suricata

🚀Introducing SO-CRATES 1.0 — Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!

SO-CRATES is a single container image for analyzing pcap files, log files, and binary files. It was formerly known as OhMyPCAP.

Here's what you can do with SO-CRATES:
✅analyze pcap files and then review Suricata alerts, metadata, and extracted files
✅import log files and then review Sigma alerts and the original log entries
✅import binary files and then review YARA matches and file metadata

All of this runs in a single Docker/Podman container — perfect for air-gapped environments, malware analysis, incident response, threat hunting, forensics & teaching.

Who’s trying it out? Drop a ❤️ and reply with your main use case!

#DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma

@securityonion
@chrissanders88

🚀Introducing SO-CRATES 1.0 — Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!

SO-CRATES is a single container image for analyzing pcap files, log files, and binary files. It was formerly known as OhMyPCAP.

Here's what you can do with SO-CRATES:
✅analyze pcap files and then review Suricata alerts, metadata, and extracted files
✅import log files and then review Sigma alerts and the original log entries
✅import binary files and then review YARA matches and file metadata

All of this runs in a single Docker/Podman container — perfect for air-gapped environments, malware analysis, incident response, threat hunting, forensics & teaching.

Who’s trying it out? Drop a ❤️ and reply with your main use case!

#DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma

@securityonion
@chrissanders88

----------------

🛠️ Tool: Pcap2Timeline - Fast PCAP triage into analyst-friendly CSV output
===================

Pcap2Timeline is a lightweight shell script (pcap2csv.sh) that wraps Suricata to transform raw PCAP files into structured CSV datasets. It leverages Suricata's eve.json output and converts it into multiple CSV files, one per event type, plus a chronologically merged timeline.

🔹 Key Features

The script extracts the following event categories from PCAP files:
• Alerts - Suricata rule match notifications
• DNS - Queries and responses
• HTTP - Request and response metadata
• TLS - SNI, certificate information
• FTP - Commands and file transfers
• SMB - Windows file sharing activity
• SSH - Secure shell sessions
• RDP - Remote desktop connections
• Flows - Connection statistics and metadata

Each event type gets its own CSV, and a combined capture_timeline.csv merges all events in chronological order. Custom Suricata rules can be applied via the -R flag, enabling targeted detection during triage instead of relying only on default rule sets.

🔹 Technical Implementation

The script is written in POSIX sh with no bashisms, meaning it runs on minimal Unix environments without requiring bash. Dependencies are intentionally sparse: suricata for packet processing and jq for JSON parsing. Standard POSIX utilities handle the rest.

Given an input capture.pcap, the script creates a pcap2csv_output/ directory containing separate CSVs for alerts, DNS, HTTP, TLS, FTP, flows, and the merged timeline.

This integrates cleanly with Eric Zimmerman's Timeline Explorer for interactive filtering and pivoting through the results.

🔹 Setup

sudo apt install suricata jq
sudo suricata-update
git clone https://github.com/mf1d3l/Pcap2Timeline.git
chmod +x pcap2csv.sh

Usage: ./pcap2csv.sh <input.pcap> [-R <rules-file.rules>]

🔹 Considerations

The tool fills a specific niche: rapid initial triage, not deep analysis. It does not correlate events across categories or generate findings automatically. Analysts still need to interpret the data, but having it pre-organized by event type with a unified timeline significantly reduces orientation time within a new PCAP. The extraction is bounded by what Suricata can detect, so protocols not covered by the loaded rule set will not appear in output.

🔹 tool #PCAP #Suricata #DFIR #networkforensics

🔗 Source: https://github.com/mf1d3l/Pcap2Timeline

----------------

🛠️ Tool: Pcap2Timeline - Fast PCAP triage into analyst-friendly CSV output
===================

Pcap2Timeline is a lightweight shell script (pcap2csv.sh) that wraps Suricata to transform raw PCAP files into structured CSV datasets. It leverages Suricata's eve.json output and converts it into multiple CSV files, one per event type, plus a chronologically merged timeline.

🔹 Key Features

The script extracts the following event categories from PCAP files:
• Alerts - Suricata rule match notifications
• DNS - Queries and responses
• HTTP - Request and response metadata
• TLS - SNI, certificate information
• FTP - Commands and file transfers
• SMB - Windows file sharing activity
• SSH - Secure shell sessions
• RDP - Remote desktop connections
• Flows - Connection statistics and metadata

Each event type gets its own CSV, and a combined capture_timeline.csv merges all events in chronological order. Custom Suricata rules can be applied via the -R flag, enabling targeted detection during triage instead of relying only on default rule sets.

🔹 Technical Implementation

The script is written in POSIX sh with no bashisms, meaning it runs on minimal Unix environments without requiring bash. Dependencies are intentionally sparse: suricata for packet processing and jq for JSON parsing. Standard POSIX utilities handle the rest.

Given an input capture.pcap, the script creates a pcap2csv_output/ directory containing separate CSVs for alerts, DNS, HTTP, TLS, FTP, flows, and the merged timeline.

This integrates cleanly with Eric Zimmerman's Timeline Explorer for interactive filtering and pivoting through the results.

🔹 Setup

sudo apt install suricata jq
sudo suricata-update
git clone https://github.com/mf1d3l/Pcap2Timeline.git
chmod +x pcap2csv.sh

Usage: ./pcap2csv.sh <input.pcap> [-R <rules-file.rules>]

🔹 Considerations

The tool fills a specific niche: rapid initial triage, not deep analysis. It does not correlate events across categories or generate findings automatically. Analysts still need to interpret the data, but having it pre-organized by event type with a unified timeline significantly reduces orientation time within a new PCAP. The extraction is bounded by what Suricata can detect, so protocols not covered by the loaded rule set will not appear in output.

🔹 tool #PCAP #Suricata #DFIR #networkforensics

🔗 Source: https://github.com/mf1d3l/Pcap2Timeline

At the Boston Official Cybersecurity Summit, Dr. Kelley Misata closed with “Trusted by Default: The Open Source Risk Hiding in Plain Sight.”

Her session brought OISF’s open source security perspective into the room and connected it to our work supporting #Suricata.

Thank you to all who joined!

At the Boston Official Cybersecurity Summit, Dr. Kelley Misata closed with “Trusted by Default: The Open Source Risk Hiding in Plain Sight.”

Her session brought OISF’s open source security perspective into the room and connected it to our work supporting #Suricata.

Thank you to all who joined!

Suricata often enters the workflow before it enters the conversation through SOC distributions, training labs, alert pipelines, vendor products, or rules firing in another interface.

To better understand what Suricata is doing under the hood, start here: https://suricata.io/learn/learning-library/
#Suricata #LearningLibrary

Suricata often enters the workflow before it enters the conversation through SOC distributions, training labs, alert pipelines, vendor products, or rules firing in another interface.

To better understand what Suricata is doing under the hood, start here: https://suricata.io/learn/learning-library/
#Suricata #LearningLibrary

We've recently merged 2 new rulesets into the Suricata Intel Index! The IPFire DBL (https://www.ipfire.org/dbl) and the Antiphishing ruleset (https://github.com/julioliraup/Antiphishing) by julioliraup. Thanks!!

#suricata

How do you actually use AI with Suricata in practice?

In this webinar, Peter Manev walks through analyzing network metadata and alert payloads with AI as part of the workflow, using XLoader as the example.

Replay: https://www.youtube.com/watch?v=tuR2SRhMqQQ

#Suricata #OpenSource #Webinar

Want to learn more about Suricata? Our webinar library is a great place to start.

Explore sessions from across the community covering practical use cases, deployments, workflows, and real-world ideas from people building with Suricata.

suricata.io/webinars/

#suricata #suricata-webinars
#freewebinar