Deployment Types

When you create a cluster, the first step of the Cluster Setup Wizard asks how IDSTower should take charge of your Suricata hosts. There are two choices, and the one you pick decides how much of the host IDSTower touches.

Fresh Installation

IDSTower installs Suricata itself and fully manages it from then on: it installs the packages, owns the configuration, deploys rules and IOCs, controls the services and monitors their health.

This is the right choice for a host that is not yet running Suricata, or one you are happy for IDSTower to take over completely.

Note

If IDSTower finds Suricata already installed on a host during a Fresh deployment, it stops before changing anything on that host and tells you which host is affected, so a mistyped hostname cannot silently replace a working installation. If you did intend to replace it, tick Take over the existing Suricata installation and continue.

Onboard Existing Suricata

IDSTower connects to hosts that already run Suricata over SSH and adopts what it finds, rather than installing anything. This lets you bring an existing deployment under management — for monitoring, for rules, or eventually for full configuration management — without rebuilding it.

What IDSTower detects

During onboarding IDSTower inspects each host and discovers, per Suricata instance:

  • the systemd service that runs it

  • the configuration file it was started with

  • its rules directory and its log directory

  • the network interfaces it is monitoring

  • the path of the Suricata binary

  • the installed Suricata version

Rather than assuming a layout from the distribution name, IDSTower asks the host directly — which is what allows it to onboard hosts whose paths do not match their distribution’s convention.

Note

A backup of the existing Suricata configuration is taken before anything is changed on the host.

Reviewing the detected instances

The wizard shows what it found on each host so you can confirm or correct it before the cluster is created. Values IDSTower could not determine are left for you to fill in; a host that reports no usable Suricata instance is reported rather than silently skipped.

Adding hosts later

An onboarded cluster is not frozen. You can add further hosts to it afterwards from the cluster’s Hosts tab, and they go through the same detection flow.

Which capabilities apply

A Fresh Installation is fully managed by definition — IDSTower installed Suricata, so every management capability is in force and there is nothing to choose.

Onboarded clusters are the ones with a choice: you decide how much of the existing installation IDSTower should take responsibility for, and you can change that at any time afterwards. See Management Capabilities.