OISF builds Suricata for Rocky Linux, AlmaLinux and RHEL in its Copr repository, and that package already has most of the high-speed capture features: eBPF, XDP and DPDK support. Two things are left out: AF_XDP capture, and the eBPF programs themselves, which the build compiles but doesn’t package. You may also need a feature that
Building a Custom Suricata RPM Package Read More »
Summary If you already run Suricata, you should not have to tear it down in order to manage it centrally. In this post I will explain why “rebuild it our way” is the wrong answer for a production IDS, and how IDSTower now onboards an existing Suricata installation instead — detecting what you already run,
Manage your existing Suricata installation without reinstalling it Read More »
The Emerging Threats Open Suricata Ruleset file contains 35,000 IDS Rules as of today, These rules, crafted by a team of experts over many years, certainly deliver value in protecting networks. However, it’s certain that you do not need all of them enabled in your network. These 35,000+ rules are designed to detect attacks across
Customize your Suricata IDS Rules per Cluster Read More »
Updated October 2026: rewritten for Suricata 8.0 on Ubuntu 24.04 LTS. The April 2023 version built Suricata 6.0, which reached end of life in August 2024. The package now lists every library it needs, builds with the same compiler hardening as the official package, adds AF_XDP capture and Suricata’s eBPF programs, and keeps apt from
Building a Custom Suricata DEB Package Read More »
Updated October 2026: ThreatFox now requires a free Auth-Key and returns at most the last seven days of IOCs. Continuing our posts on why and how to alert on Indicators of Compromise with Suricata’s Datasets, this post shows how to alert on known-malicious files seen on the network, using SHA256 hashes published by abuse.ch ThreatFox.
Configuring Suricata IDS to alert on Malicious File Hashes Read More »
Updated October 2026: ThreatFox now requires a free Auth-Key on every API request, and returns at most the last seven days of IOCs. The commands below are updated for both and were re-tested on Suricata 7.0 and 8.0. In our previous post, we talked about why you should use Suricata IDS to alert on IOCs.
Alerting on IOCs using Suricata Read More »
Summary In this post, I will explain why you should utilize Suricata IDS to alert on Network-Based Indicators of Compromise (IOCs), what are the traditional approach and its limitations, How Suricata will differ & what advantages you will get. Introduction Traditionally, SOC Operators used network Indicators of Compromise (IOCs) (eg: domains, IP…etc.) to detect malicious
Why you should use Suricata IDS to alert on IOCs Read More »
