clamav VS Suricata

My recommendation would be to use ClamAV an open source antivirus engine. It is a versatile tool designed to detect multiple types of threats from numerous file formats and other use cases (cross-platform, integration such as mail server). Finally, it is updated on a daily basis, ensuring protection against the latest known threats. This rapid update cycle is crucial for an antivirus tool to be effective.

Linux has (free) tools to improve security and detect/remove malware: Lynis,Chkrootkit,Rkhunter,ClamAV,Vuls,LMD,radare2,Yara,ntopng,maltrail,Snort,Suricata...

There's clamAV which is open source: https://www.clamav.net/

For personal use, the most commonly used is ClamAV.

Absolutely but if the OP feels they must then they should look into the free ClamAV.

I'd go with what Bman said but second to that ClamAV is a good free option.

Ehhh, there is antivirus software for Linux, like ClamAV. Also a lot of exploits these days target browsers since its an easier attack vector. Also, malware is malware, and most servers use Linux by default. So any malware that's targeting a Linux server could target a desktop user. I don't like the whole "Haha, malware doesn't affect me because everyone targets windows". Sure, those "download now!" buttons that are targeted to gullible windows users might not work on your operating system however your OS is still vulnerable and can still be exploited by malware.

Linux has (free) tools to improve security and detect/remove malware: Lynis,Chkrootkit,Rkhunter,ClamAV,Vuls,LMD,radare2,Yara,ntopng,maltrail,Snort,Suricata...

Monitoring & Active Measures - Exporting firewall events to an external time-series database like I describe above is good to see who is touching your firewall or accessing your web site. Using an Intrusion Detection System / Intrusion Prevention System (IDS/IPS) such as open-source Suricata, which is a free package on pfSense, and deploying file system integrity monitoring, such as the open-source Wazuh on the exposed server are also good approaches to protecting yourself.

You could try running Suricata

Check out https://suricata.io/

Suricata: https://suricata.io/ IDS/IPS

Active Measures - Includes (IDS/IPS) such as open-source Suricata or Snort on pfSense, and File Integrity Monitoring (FIM), such as the commercial Tripwire and dated, open-source Tripwire, or the open-source Wazuh installed on servers. These can be combined into a Security Information and Event Management (SIEM) system like the open-source solution, Security Onion. Wazuh itself has evolved into a SIEM.

Active measures may include an intrusion detection system / intrusion prevention systems (IDS/IPS) such as open-source Suricata on the firewall, and installing file system integrity monitoring, such as the open-source Wazuh on the exposed server. These are combined in one open-source solution, Security Onion