[38;5;12m                                                                            [39m[38;2;255;187;0m[1m[4mAwesome Suricata [0m[38;5;14m[1m[4m![0m[38;2;255;187;0m[1m[4mAwesome[0m[38;5;14m[1m[4m (https://awesome.re/badge-flat2.svg)[0m[38;2;255;187;0m[1m[4m (https://awesome.re)[0m

[38;5;12m (https://suricata.io)[39m

[38;5;11m[1m▐[0m[38;5;12m [39m[38;5;12mCurated list of awesome things related to Suricata.[39m

[38;5;14m[1mSuricata[0m[38;5;12m (https://suricata.io/features) is a free intrusion detection/prevention system (IDS/IPS) and network security monitoring engine.[39m

[38;2;255;187;0m[4mContents[0m

[38;5;12m- [39m[38;5;14m[1mInput Tools[0m[38;5;12m (#input-tools)[39m
[38;5;12m- [39m[38;5;14m[1mOutput Tools[0m[38;5;12m (#output-tools)[39m
[38;5;12m- [39m[38;5;14m[1mOperations, Monitoring and Troubleshooting[0m[38;5;12m (#operations-monitoring-and-troubleshooting)[39m
[38;5;12m- [39m[38;5;14m[1mProgramming Libraries and Toolkits[0m[38;5;12m (#programming-libraries-and-toolkits)[39m
[38;5;12m- [39m[38;5;14m[1mDashboards and Templates[0m[38;5;12m (#dashboards-and-templates)[39m
[38;5;12m- [39m[38;5;14m[1mDevelopment Tools[0m[38;5;12m (#development-tools)[39m
[38;5;12m- [39m[38;5;14m[1mDocumentation and Guides[0m[38;5;12m (#documentation-and-guides)[39m
[38;5;12m- [39m[38;5;14m[1mAnalysis Tools[0m[38;5;12m (#analysis-tools)[39m
[38;5;12m- [39m[38;5;14m[1mRule Sets[0m[38;5;12m (#rule-sets)[39m
[38;5;12m- [39m[38;5;14m[1mRule/Security Content Management and Handling[0m[38;5;12m (#rulesecurity-content-management-and-handling)[39m
[38;5;12m- [39m[38;5;14m[1mSystems Using Suricata[0m[38;5;12m (#systems-using-suricata)[39m
[38;5;12m- [39m[38;5;14m[1mTraining[0m[38;5;12m (#training)[39m
[38;5;12m- [39m[38;5;14m[1mSimulation and Testing[0m[38;5;12m (#simulation-and-testing)[39m
[38;5;12m- [39m[38;5;14m[1mData Sets[0m[38;5;12m (#data-sets)[39m
[38;5;12m- [39m[38;5;14m[1mMisc[0m[38;5;12m (#misc)[39m


[38;2;255;187;0m[4mInput Tools[0m

[38;5;12m- [39m[38;5;14m[1mPacketStreamer[0m[38;5;12m (https://github.com/deepfence/PacketStreamer) - Distributed tcpdump for cloud native environments.[39m


[38;2;255;187;0m[4mOutput Tools[0m

[38;5;12m- [39m[38;5;14m[1msuricata-kafka-output[0m[38;5;12m (https://github.com/Center-Sun/suricata-kafka-output) - Suricata Eve Kafka Output Plugin for Suricata 6.[39m
[38;5;12m- [39m[38;5;14m[1msuricata-redis-output[0m[38;5;12m (https://github.com/jasonish/suricata-redis-output) - Suricata Eve Redis Output Plugin for Suricata 7.[39m
[38;5;12m- [39m[38;5;14m[1mMeer[0m[38;5;12m (https://github.com/quadrantsec/meer) - Meer is a "spooler" for Suricata / Sagan.[39m
[38;5;12m- [39m[38;5;14m[1mFEVER[0m[38;5;12m (https://github.com/DCSO/fever) - Fast, extensible, versatile event router for Suricata's EVE-JSON format.[39m
[38;5;12m- [39m[38;5;14m[1mSuricata-Logstash-Templates[0m[38;5;12m (https://github.com/pevma/Suricata-Logstash-Templates) - Templates for Kibana/Logstash to use with Suricata IDPS.[39m
[38;5;12m- [39m[38;5;14m[1mLilith[0m[38;5;12m (https://github.com/VVelox/Lilith) - Reads EVE files into SQL as well as search stored data.[39m


[38;2;255;187;0m[4mOperations, Monitoring and Troubleshooting[0m

[38;5;12m- [39m[38;5;14m[1mslinkwatch[0m[38;5;12m (https://github.com/DCSO/slinkwatch) - Automatic enumeration and maintenance of Suricata monitoring interfaces.[39m
[38;5;12m- [39m[38;5;14m[1msuri-stats[0m[38;5;12m (https://github.com/regit/suri-stats) - A tool to work on suricata [39m[48;5;235m[38;5;249mstats.log[49m[39m[38;5;12m file.[39m
[38;5;12m- [39m[38;5;14m[1mMauerspecht[0m[38;5;12m (https://github.com/DCSO/mauerspecht) - Simple Probing Tool for Corporate Walled Garden Networks.[39m
[38;5;12m- [39m[38;5;14m[1mansible-suricata[0m[38;5;12m (https://github.com/GitMirar/ansible-suricata) - Suricata Ansible role (slightly outdated).[39m
[38;5;12m- [39m[38;5;14m[1mMassDeploySuricata[0m[38;5;12m (https://github.com/pevma/MassDeploySuricata) - Mass deploy and update Suricata IDPS using Ansible IT automation platform.[39m
[38;5;12m- [39m[38;5;14m[1mdocker-suricata[0m[38;5;12m (https://github.com/jasonish/docker-suricata) - Suricata Docker image.[39m
[38;5;12m- [39m[38;5;14m[1mSuricata-Monitoring[0m[38;5;12m (https://github.com/VVelox/Suricata-Monitoring) - LibreNMS JSON / Nagios monitor for Suricata stats.[39m
[38;5;12m- [39m[38;5;14m[1mTerraform Module for Suricata[0m[38;5;12m (https://github.com/onetwopunch/terraform-google-suricata) - Terraform module to setup Google Cloud packet mirroring and send packets to Suricata.[39m
[38;5;12m- [39m[38;5;14m[1mInfluxDB Suricata Input Plugin[0m[38;5;12m (https://github.com/influxdata/telegraf/tree/master/plugins/inputs/suricata) - Input Plugin for Telegraf to collect and forward Suricata [39m[48;5;235m[38;5;249mstats[49m[39m[38;5;12m logs (included out of the box in recent Telegraf releases).[39m
[38;5;12m- [39m[38;5;14m[1msuricata_exporter[0m[38;5;12m (https://github.com/corelight/suricata_exporter) - Simple Prometheus exporter written in Go exporting stats metrics scraped from Suricata socket.[39m

[38;2;255;187;0m[4mProgramming Libraries and Toolkits[0m

[38;5;12m- [39m[38;5;14m[1mrust-suricatax-rule-parser[0m[38;5;12m (https://github.com/jasonish/rust-suricatax-rule-parser) - Experimental Suricata Rule Parser in Rust.[39m
[38;5;12m- [39m[38;5;14m[1mgo-suricata[0m[38;5;12m (https://github.com/ks2211/go-suricata) - Go Client for Suricata (Interacting via Socket).[39m
[38;5;12m- [39m[38;5;14m[1mgonids[0m[38;5;12m (https://github.com/google/gonids) - Go library to parse intrusion detection rules for engines like Snort and Suricata.[39m
[38;5;12m- [39m[38;5;14m[1msurevego[0m[38;5;12m (https://github.com/rhaist/surevego) - Suricata EVE-JSON parser in Go.[39m
[38;5;12m- [39m[38;5;14m[1msuricataparser[0m[38;5;12m (https://github.com/m-chrome/py-suricataparser) - Pure python parser for Snort/Suricata rules.[39m
[38;5;12m- [39m[38;5;14m[1mpy-idstools[0m[38;5;12m (https://github.com/jasonish/py-idstools) - Snort and Suricata Rule and Event Utilities in Python (Including a Rule Update Tool).[39m


[38;2;255;187;0m[4mDashboards and Templates[0m

[38;5;12m- [39m[38;5;14m[1mKTS[0m[38;5;12m (https://github.com/StamusNetworks/KTS) - Kibana 4 Templates for Suricata IDPS Threat Hunting.[39m
[38;5;12m- [39m[38;5;14m[1mKTS5[0m[38;5;12m (https://github.com/StamusNetworks/KTS5) - Kibana 5 Templates for Suricata IDPS Threat Hunting.[39m
[38;5;12m- [39m[38;5;14m[1mKTS6[0m[38;5;12m (https://github.com/StamusNetworks/KTS6) - Kibana 6 Templates for Suricata IDPS Threat Hunting.[39m
[38;5;12m- [39m[38;5;14m[1mKTS7[0m[38;5;12m (https://github.com/StamusNetworks/KTS7) - Kibana 7 Templates for Suricata IDPS Threat Hunting.[39m


[38;2;255;187;0m[4mDevelopment Tools[0m

[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mSuricata[0m[38;5;14m[1m [0m[38;5;14m[1mLanguage[0m[38;5;14m[1m [0m[38;5;14m[1mServer[0m[38;5;12m [39m[38;5;12m(https://github.com/StamusNetworks/suricata-language-server)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mSuricata[39m[38;5;12m [39m[38;5;12mLanguage[39m[38;5;12m [39m[38;5;12mServer[39m[38;5;12m [39m[38;5;12mis[39m[38;5;12m [39m[38;5;12man[39m[38;5;12m [39m[38;5;12mimplementation[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mLanguage[39m[38;5;12m [39m[38;5;12mServer[39m[38;5;12m [39m[38;5;12mProtocol[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mSuricata[39m[38;5;12m [39m[38;5;12msignatures.[39m[38;5;12m [39m[38;5;12mIt[39m[38;5;12m [39m[38;5;12madds[39m[38;5;12m [39m[38;5;12msyntax[39m[38;5;12m [39m[38;5;12mcheck,[39m[38;5;12m [39m[38;5;12mhints[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m
[38;5;12mauto-completion[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12myour[39m[38;5;12m [39m[38;5;12mpreferred[39m[38;5;12m [39m[38;5;12meditor[39m[38;5;12m [39m[38;5;12monce[39m[38;5;12m [39m[38;5;12mit[39m[38;5;12m [39m[38;5;12mis[39m[38;5;12m [39m[38;5;12mconfigured.[39m
[38;5;12m- [39m[38;5;14m[1msuricata-ls-vscode[0m[38;5;12m (https://github.com/StamusNetworks/suricata-ls-vscode) - Suricata IntelliSense Extension using the Suricata Language Server.[39m
[38;5;12m- [39m[38;5;14m[1msuricata-highlight-vscode[0m[38;5;12m (https://github.com/dgenzer/suricata-highlight-vscode) - Suricata Rules Support for Visual Studio Code (syntax highlighting, etc).[39m
[38;5;12m- [39m[38;5;14m[1mSublimeSuricata[0m[38;5;12m (https://github.com/ozuriexv/SublimeSuricata) - Basic Suricata syntax highlighter for Sublime Text.[39m


[38;2;255;187;0m[4mDocumentation and Guides[0m

[38;5;12m- [39m[38;5;14m[1mSEPTun[0m[38;5;12m (https://github.com/pevma/SEPTun) - Suricata Extreme Performance Tuning guide.[39m
[38;5;12m- [39m[38;5;14m[1mSEPTun-Mark-II[0m[38;5;12m (https://github.com/pevma/SEPTun-Mark-II) - Suricata Extreme Performance Tuning guide - Mark II.[39m
[38;5;12m- [39m[38;5;14m[1msuricata-4-analysts[0m[38;5;12m (https://github.com/StamusNetworks/suricata-4-analysts) - The Security Analyst's Guide to Suricata.[39m


[38;2;255;187;0m[4mAnalysis Tools[0m

[38;5;12m- [39m[38;5;14m[1mSuricata Analytics[0m[38;5;12m (https://github.com/StamusNetworks/suricata-analytics) - Various resources that are useful when interacting with Suricata data.[39m
[38;5;12m- [39m[38;5;14m[1mMalcolm[0m[38;5;12m (https://github.com/cisagov/Malcolm) - A powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.[39m
[38;5;12m- [39m[38;5;14m[1mEvebox[0m[38;5;12m (https://github.com/jasonish/evebox) - Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search.[39m


[38;2;255;187;0m[4mRule Sets[0m

[38;5;12m- [39m[38;5;14m[1mnids-rule-library[0m[38;5;12m (https://github.com/klingerko/nids-rule-library#readme) - Collection of various open-source and commercial rulesets.[39m
[38;5;12m- [39m[38;5;14m[1mStamus Lateral Movement Detection Rules[0m[38;5;12m (https://www.stamus-networks.com/blog/new-open-ruleset-for-detecting-lateral-movement-with-suricata) - Suricata ruleset to detect lateral movement.[39m
[38;5;12m- [39m[38;5;14m[1mQuadrantSec Suricata Rules[0m[38;5;12m (https://github.com/quadrantsec/suricata-rules) - QuadrantSec Suricata rules.[39m
[38;5;12m- [39m[38;5;14m[1mCluster25/detection[0m[38;5;12m (https://github.com/Cluster25/detection) - Cluster25's detection rules.[39m
[38;5;12m- Networkforensic.dk (NF) rules sets: [39m
[38;5;12m  - [39m[38;5;14m[1mNF IDS rules[0m[38;5;12m (https://networkforensic.dk/SNORT/NF-local.zip)[39m
[38;5;12m  - [39m[38;5;14m[1mNF SCADA IDS Rules[0m[38;5;12m (https://networkforensic.dk/SNORT/NF-SCADA.zip)[39m
[38;5;12m  - [39m[38;5;14m[1mNF Scanners IDS Rules[0m[38;5;12m (https://networkforensic.dk/SNORT/NF-Scanners.zip)[39m
[38;5;12m- [39m[38;5;14m[1mQuantum Insert detection for Suricata[0m[38;5;12m (https://github.com/fox-it/quantuminsert/blob/master/detection/suricata/README.md) - Suricata rules accompanying Fox-IT's QUANTUM 2015 blog/BroCon talk.[39m
[38;5;12m- [39m[38;5;14m[1mHunting rules[0m[38;5;12m (https://github.com/travisbgreen/hunting-rules) - Suricata IDS alert rules for network anomaly detection from Travis Green.[39m
[38;5;12m- [39m[38;5;14m[1m3CORESec NIDS - Lateral Movement[0m[38;5;12m (https://dtection.io/ruleset/3cs_lateral) - Suricata ruleset focusing on lateral movement techniques (paid).[39m
[38;5;12m- [39m[38;5;14m[1m3CORESec NIDS - Sinkholes[0m[38;5;12m (https://dtection.io/ruleset/3cs_sinkholes) - Suricata ruleset focused on a curated list of public malware sinkholes (free).[39m
[38;5;12m- [39m[38;5;14m[1mPAW Patrules[0m[38;5;12m (https://pawpatrules.fr) - Another free (CC BY-NC-SA) collection of rules for the Suricata engine.[39m


[38;2;255;187;0m[4mRule/Security Content Management and Handling[0m

[38;5;12m- [39m[38;5;14m[1msidallocation.org[0m[38;5;12m (https://sidallocation.org/) - Sid Allocation working group, list of SID ranges.[39m
[38;5;12m- [39m[38;5;14m[1mScirius[0m[38;5;12m (https://github.com/StamusNetworks/scirius) - Web application for Suricata ruleset management and threat hunting.[39m
[38;5;12m- [39m[38;5;14m[1mIOCmite[0m[38;5;12m (https://github.com/sebdraven/IOCmite) - Tool to create dataset for suricata with indicators of MISP instances and add sightings in MISP if an indicator of dataset generates an alert.[39m
[38;5;12m- [39m[38;5;14m[1mluaevilbit[0m[38;5;12m (https://github.com/regit/luaevilbit) - An Evil bit implementation in luajit for Suricata.[39m
[38;5;12m- [39m[38;5;14m[1mLawmaker[0m[38;5;12m (https://www.3coresec.com/solutions/lawmaker) - Suricata IDS rule and fleet management system.[39m
[38;5;12m- [39m[38;5;14m[1msurify-cli[0m[38;5;12m (https://github.com/dgenzer/surify-cli) - Generate suricata-rules from collection of IOCs (JSON, CSV or flags) based on your suricata template.[39m
[38;5;12m- [39m[38;5;14m[1msuricata-prettifier[0m[38;5;12m (https://github.com/theY4Kman/suricata-prettifier) - Command-line tool to format and syntax highlight Suricata rules.[39m
[38;5;12m- [39m[38;5;14m[1mOTX-Suricata[0m[38;5;12m (https://github.com/AlienVault-OTX/OTX-Suricata) - Create rules and configuration for Suricata to alert on indicators from an OTX account.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mAristotle[0m[38;5;12m [39m[38;5;12m(https://github.com/secureworks/aristotle)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mSimple[39m[38;5;12m [39m[38;5;12mPython[39m[38;5;12m [39m[38;5;12mprogram[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12mallows[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mfiltering[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mmodifying[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mSuricata[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mSnort[39m[38;5;12m [39m[38;5;12mrulesets[39m[38;5;12m [39m[38;5;12mbased[39m[38;5;12m [39m[38;5;12mon[39m[38;5;12m [39m[38;5;12minterpreted[39m[38;5;12m [39m[38;5;12mkey-value[39m[38;5;12m [39m[38;5;12mpairs[39m[38;5;12m [39m[38;5;12mpresent[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mmetadata[39m[38;5;12m [39m[38;5;12mkeyword[39m[38;5;12m [39m[38;5;12mwithin[39m[38;5;12m [39m[38;5;12meach[39m[38;5;12m [39m
[38;5;12mrule.[39m


[38;2;255;187;0m[4mSystems Using Suricata[0m

[38;5;12m- [39m[38;5;14m[1mSELKS[0m[38;5;12m (https://github.com/StamusNetworks/SELKS) - A Suricata-based intrusion detection system/intrusion prevention system/network security monitoring distribution.[39m
[38;5;12m- [39m[38;5;14m[1mAmsterdam[0m[38;5;12m (https://github.com/StamusNetworks/Amsterdam) - Docker based Suricata, Elasticsearch, Logstash, Kibana, Scirius aka SELKS.[39m
[38;5;12m- [39m[38;5;14m[1mpfSense[0m[38;5;12m (https://www.pfsense.org) - A free network firewall distribution, based on the FreeBSD operating system with a custom kernel and including third party free software packages for additional functionality.[39m
[38;5;12m- [39m[38;5;14m[1mOPNsense[0m[38;5;12m (https://opnsense.org) - An open source, easy-to-use and easy-to-build FreeBSD based firewall and routing platform.[39m


[38;2;255;187;0m[4mTraining[0m

[38;5;12m- [39m[38;5;14m[1mExperimental Suricata Training Environment[0m[38;5;12m (https://github.com/jasonish/experimental-suricata-training) - Experimental Suricata Training Environment.[39m
[38;5;12m- [39m[38;5;14m[1mCDMCS[0m[38;5;12m (https://github.com/ccdcoe/CDMCS/tree/master) - Cyber Defence Monitoring Course: Rule-based Threat Detection.[39m


[38;2;255;187;0m[4mSimulation and Testing[0m

[38;5;12m- [39m[38;5;14m[1mLeonidas[0m[38;5;12m (https://github.com/WithSecureLabs/leonidas) - Automated Attack Simulation in the Cloud, complete with detection use cases.[39m
[38;5;12m- [39m[38;5;14m[1mspeeve[0m[38;5;12m (https://github.com/satta/speeve) - Fast, probabilistic EVE-JSON generator for testing and benchmarking of EVE-consuming applications.[39m
[38;5;12m- [39m[38;5;14m[1mDalton[0m[38;5;12m (https://github.com/secureworks/dalton) - Suricata and Snort IDS rule and pcap testing system.[39m


[38;2;255;187;0m[4mData Sets[0m

[38;5;12m- [39m[38;5;14m[1msuricata-sample-data[0m[38;5;12m (https://github.com/FrankHassanabad/suricata-sample-data) - Repository of creating different example suricata data sets.[39m


[38;2;255;187;0m[4mMisc[0m

[38;5;12m- [39m[38;5;14m[1mSuriwire[0m[38;5;12m (https://github.com/regit/suriwire) - Wireshark plugin to display Suricata analysis info.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mbash_cata[0m[38;5;12m [39m[38;5;12m(https://github.com/isMTv/bash_cata)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mA[39m[38;5;12m [39m[38;5;12msimple[39m[38;5;12m [39m[38;5;12mscript[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12mprocesses[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mgenerated[39m[38;5;12m [39m[38;5;12mSuricata[39m[38;5;12m [39m[38;5;12meve-log[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mreal[39m[38;5;12m [39m[38;5;12mtime[39m[38;5;12m [39m[38;5;12mand,[39m[38;5;12m [39m[38;5;12mbased[39m[38;5;12m [39m[38;5;12mon[39m[38;5;12m [39m[38;5;12malerts,[39m[38;5;12m [39m[38;5;12madds[39m[38;5;12m [39m[38;5;12man[39m[38;5;12m [39m[38;5;12mip-address[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mMikroTik[39m[38;5;12m [39m[38;5;12mAddress[39m[38;5;12m [39m[38;5;12mLists[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mspecified[39m[38;5;12m [39m[38;5;12mtime[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12msubsequent[39m[38;5;12m [39m
[38;5;12mblocking.[39m
[38;5;12m- [39m[38;5;14m[1msuriGUI[0m[38;5;12m (https://github.com/control-owl/suriGUI) - GUI for Suricata + Qubes OS.[39m
