OISF/suricata

Health v2 · maintenance only

Adoption not part of the score

6571 stars · 1760 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Suricata is a high-performance network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine written in C. It inspects live traffic or pcap files to detect threats, log events, and optionally block malicious traffic.

Use cases

• detect intrusions on my network
• block malicious traffic inline with an ips
• monitor network traffic for threats
• analyze pcap files for suspicious activity
• threat hunting with network metadata and logs
• replace snort with a multithreaded ids
• generate network flow and protocol logs for security monitoring

When to choose

• you need a mature, actively maintained IDS/IPS with deep protocol parsing and rule-based detection
• you want multithreaded performance for high-throughput network monitoring
• you need combined IDS, IPS, and NSM capabilities in one engine

When to avoid

• you only need host-based intrusion detection or endpoint security
• you want a simple firewall rather than signature-based traffic inspection
• you need a lightweight sensor for embedded devices with minimal resources

Facets

application · maturity stable

security monitoring networking alerting security networking monitoring cross-platform cli ids ips nsm intrusion-detection threat-hunting deep-packet-inspection network-security-monitoring c linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="OISF/suricata")