Top 11 suricatum Open-Source Projects

• Suricata

  23 4,034 9.9 C

  Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

  

Project mention: Aho-Corasick Algorithm | news.ycombinator.com | 2024-03-04

• PacketStreamer

  15 1,855 2.8 Go

  :star: :star: :star: Distributed tcpdump for cloud native environments :star: :star: :star:

  

Project mention: Traffic Mirroring in Azure | /r/AskNetsec | 2023-05-13

Also: - https://github.com/deepfence/PacketStreamer

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• Malcolm

  4 1,736 9.9 Python

  Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

  

• tenzir

  15 609 10.0 C++

  Open source security data pipelines.

  

Project mention: Vector: A high-performance observability data pipeline | news.ycombinator.com | 2024-03-17

We're building something similar at Tenzir, but more for operational security workloads. https://docs.tenzir.com

Differences to Vector:

- An agent has optional indexed storage, so you can store your data there and pick it up later. The storage is based on Apache Feather, Parquet's little brother.

- Pipelines operators both work with data frames (Arrow record batches) or chunks of bytes.

- Structured pipelines are multi-schema, i.e., a single pipeline can process streams of record batches with different schemas.

• pulledpork

  2 415 0.0 Perl

  Pulled Pork for Snort and Suricata rule management (from Google code)

• S1EM

  1 385 7.2 Shell

  This project is a SIEM with SIRP and Threat Intel, all in one.

Project mention: Homelab Cybersecurity Idea | /r/homelab | 2023-04-28

Also have an instance of S1EM - https://github.com/V1D1AN/S1EM - running, monitoring my home LAN, firewall etc. It's huge overkill, and your machine may struggle to run it if you ran anything else with it, but might be worth looking at.

• Malcolm

  5 309 9.9 Python

  Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts. (by idaholab)

  

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• py-idstools

  1 268 5.6 Python

  idstools: Snort and Suricata Rule and Event Utilities in Python (Including a Rule Update Tool)

Project mention: Regex Challenge - Field Extraction | /r/Splunk | 2023-06-12

I like this a lot. We have a in-house Snort 2 forwarder that does a similar thing with https://github.com/jasonish/py-idstools and forwards the result directly using HEC. We could use the same code base for dnstap if we wanted.

• how-to-setup-a-honeypot

  6 139 0.0

  How to setup a honeypot with an IDS, ELK and TLS traffic inspection

• impulse-xdr

  3 99 7.3 Python

  Fully automated host & network intrusion detection platform. Detects malware from behavioural patterns rather than signatures and enables deeper visibility than legacy tools.

Project mention: New host intrusion detection system Impulse | news.ycombinator.com | 2024-04-01

• SplunkDashboards

  1 49 0.0

  Collection of Dashboards for Threat Hunting and more!

suricata related posts

• How do I ensure safety when making a honeypot?
  1 project | /r/cybersecurity_help | 20 Jul 2022
• How to setup a honeypot with an IDS, ELK and TLS traffic inspection
  1 project | /r/RedSec | 12 Jul 2022
• How to setup a honeypot with an IDS, ELK and TLS traffic inspection
  1 project | /r/securednews | 12 Jul 2022
• How to setup a honeypot with an IDS, ELK and TLS traffic inspection
  1 project | /r/cybersecurity | 12 Jul 2022
• How to setup a honeypot with an IDS, ELK and TLS traffic inspection
  1 project | /r/cyber_deception | 12 Jul 2022
• Getting a lot of BF attempts on my server, any tips/ways to cut this out?
  1 project | /r/Fedora | 3 Jul 2021
• Rules update during system installation
  1 project | /r/snort | 16 Feb 2021
• A note from our sponsor - WorkOS
  workos.com | 24 Apr 2024

  The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning. Learn more →

Index

Sponsored

SaaSHub - Software Alternatives and Reviews

SaaSHub helps you find the best software and product alternatives

www.saashub.com