Third-Party Components¶
IDSTower is built on open-source components. This page lists every third-party component that ships as part of IDSTower 3.2.0, with the version in that release, the license it is distributed under, and where it comes from. It is here so that a security, procurement or vendor review can be completed from the documentation, without having to ask us for a list first.
The page is generated from the build itself - the backend project file, the frontend package manifest and the container image definition - and regenerated for every release, so it describes what is actually in the release rather than what someone wrote down once.
Note
Generated on 2026-10-17 for IDSTower 3.2.0.
What is not listed¶
Four things are left out on purpose, so that nothing here is missing by accident:
Build- and test-only dependencies. 32 of the web interface’s 35
devDependencies- compilers, linters, the test runner - produce the application and are never served to a browser. The remaining 3 (@angular/platform-browser,jquery,tslib) do reach the browser despite where they are declared, and are listed in the frontend table below rather than excluded. On the backend the same exclusion applies to the Roslyn analyzers and design-time tooling (ErrorProne.NET.CoreAnalyzers,ErrorProne.NET.Structs,Microsoft.CodeAnalysis.NetAnalyzers,Microsoft.EntityFrameworkCore.Design,SonarAnalyzer.CSharp), which the compiler consumes and which are not part of the published application.Transitive dependencies. Only the components IDSTower depends on directly are listed. Each of those carries its own dependencies, resolved by NuGet and npm at build time; the full closure is reproducible from the manifests in the source distribution.
Operating-system packages. Neither the packages of the host you install IDSTower on nor those of the Docker image base layer are inventoried here. They come from your distribution or from the base image, change independently of an IDSTower release, and a container or host scanner enumerates them far better than a page in our documentation can.
Suricata and Filebeat. IDSTower deploys, configures and manages them, but does not bundle them: each managed host installs them itself, from its own distribution’s repositories or from Elastic’s, and for offline hosts the optional Built-In Packages repository is downloaded separately and carries the publishers’ own unmodified packages. Suricata is published by the Open Information Security Foundation under the GPL-2.0; Filebeat is published by Elastic, whose default distribution is under the Elastic License 2.0, with the source also offered under the Server Side Public License. Those licenses are granted to you by their publishers rather than by us, which is why the two are not rows in the tables below. The rules and threat-intelligence feeds you subscribe to are outside this page for the same reason: each carries its provider’s own terms.
Backend (.NET)¶
The IDSTower REST API is a .NET application. These 25 NuGet packages are referenced directly by it and are distributed inside the IDSTower application package and container image.
Component |
Version |
License |
Source |
|---|---|---|---|
|
4.0.102.2 |
Apache-2.0 |
|
|
4.0.105.5 |
Apache-2.0 |
|
|
4.0.101.2 |
Apache-2.0 |
|
|
0.13.0 |
MIT |
|
|
33.1.0 |
MS-PL OR Apache-2.0 |
|
|
9.0.12 |
MIT |
|
|
10.0.12 |
MIT |
|
|
9.0.12 |
MIT |
|
|
9.0.12 |
MIT |
|
|
13.0.4 |
MIT |
|
|
3.0.0 |
BSD-3-Clause |
|
|
9.0.0 |
MIT |
github.com/PomeloFoundation/Pomelo.EntityFrameworkCore.MySql |
|
10.0.0 |
Apache-2.0 |
|
|
10.0.0 |
Apache-2.0 |
|
|
6.1.1 |
Apache-2.0 |
|
|
3.0.0 |
Apache-2.0 |
|
|
7.0.0 |
Apache-2.0 |
|
|
1.4.2 |
MIT |
|
|
7.2.0 |
MIT |
|
|
7.2.0 |
MIT |
|
|
8.0.3 |
MIT |
|
|
2.0.0-beta4.22272.1 |
MIT |
|
|
10.0.12 |
MIT |
|
|
8.23.0 |
MIT |
github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet |
|
10.0.13 |
MIT |
Frontend (Angular)¶
The IDSTower web interface is an Angular single-page application. These 26 packages are the ones that reach the browser: the manifest’s runtime dependencies, together with the packages the build injects into the page or compiles into the bundles even though they are declared as devDependencies.
Component |
Version |
License |
Source |
|---|---|---|---|
|
20.3.34 |
MIT |
|
|
20.3.34 |
MIT |
|
|
20.3.34 |
MIT |
|
|
20.3.34 |
MIT |
|
|
20.3.34 |
MIT |
|
|
20.3.34 |
MIT |
|
|
20.3.34 |
MIT |
|
|
20.3.34 |
MIT |
|
|
1.7.0 |
MIT |
|
|
2.11.8 |
MIT |
|
|
4.6.2 |
MIT |
|
|
3.6.1 |
MIT |
|
|
1.7.0 |
MIT |
|
|
6.0.0 |
BSD-3-Clause |
|
|
3.4.56 |
MIT |
|
|
3.7.1 |
MIT |
|
|
1.13.3 |
MIT |
|
|
0.52.2 |
MIT |
|
|
5.5.1 |
MIT |
|
|
1.0.0 |
MIT |
|
|
3.0.0 |
MIT |
|
|
1.16.1 |
MIT |
|
|
7.8.2 |
Apache-2.0 |
|
|
7.8.5 |
ISC |
|
|
2.8.1 |
0BSD |
|
|
0.15.1 |
MIT |
Runtime and automation¶
Two components are neither NuGet nor npm packages, and are the ones a review asks about next.
Component |
Version |
License |
Source |
|---|---|---|---|
|
10.0 |
MIT |
|
|
2.16.* |
GPL-3.0-or-later |
IDSTower performs every operation on a managed Suricata host through Ansible, so a working ansible-core is part of an IDSTower installation. The version above is the one pinned in the IDSTower Docker image, which installs ansible-core 2.16.* together with the ansible community package for its curated collections. When IDSTower is installed from a DEB or RPM package instead, Ansible is a package dependency and comes from your own distribution’s repositories, at whatever version they carry.
The .NET version above is the framework IDSTower is built against (net10.0). The self-contained packages and the container image bundle that runtime; a framework-dependent installation uses the .NET runtime installed on the host.
Questions about a component¶
If your review needs something this page does not answer - a full dependency tree, a license text, an SPDX document, or confirmation about a specific CVE - contact us and we will provide it.