Suricata
Free · OSSNetwork & IDS
Deep packet inspection for everything crossing the wire.
Suricata homepage ↗Watches every packet crossing your network for known-bad signatures and protocol anomalies. The OSS equivalent of a commercial IDS appliance — runs on commodity hardware, no per-Mbps licensing.
Production-shippable, newer or thinner field coverage. Watch the changelog before pinning compliance claims.
What it watches
- Signature matches against the Emerging Threats / Suricata rulesets — known C2, exploits, scanners
- Protocol anomalies — malformed TLS, DNS tunneling, traffic on unexpected ports
- File extractions + hashes pulled straight from network streams
- JA3/TLS fingerprints of suspicious clients
- Lateral-movement patterns over SMB, RDP, WMI
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
1 event type
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| ids | Security rule match on suricata |
What it helps you catch
What you'd see in CyberCLI
illustrativeOutbound C2 beacon to known-bad 203.0.113.25
- src
- 10.0.0.42
- dst
- 203.0.113.25
- signature
- ET MALWARE Cobalt Strike
- proto
- TLS
Routed to Warden (triage) → Knight (detection) → Marshal (response-planning)
Suggested Block destination at firewall (needs approval)
⛓ every step hash-chained · replayable
What CyberCLI reads from Suricata
audit our mathSuricata emits EVE-JSON for every flow it inspects. The 20 fields we read are the full per-event story: srcip/dstip/sport/dport/proto, app-layer details (HTTP host/URI/UA, DNS query/response, TLS SNI, JA3 fingerprint), and the alert signature that fired (sid, msg, severity, category). Enough to triage without going back to the PCAP.
Full field index · 20 fields ↓
.action.alert_category.alert_severity.alert_signature.app_proto.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_wire_format.dst_ip.dst_port.event_id.event_timestamp.event_type.flow_id.proto.rule_id.rule_level.src_ip.src_port MITRE techniques typically mapped
- T1190 ↗
Exploit Public-Facing ApplicationInitial Access
- T1071.001 ↗
Web Protocols (HTTP/S C2)Command and Control
- T1071.004 ↗
DNS C2Command and Control
- T1572 ↗
Protocol TunnelingCommand and Control
- T1219 ↗
Remote Access SoftwareCommand and Control
Trust Ladder ceiling · L0 → L3
- ·L0–L2: digest the alert, notify, correlate with the rest of the case
- ·L3 (Knight verification): TI-feed lookup on srcip/JA3/domain, sandbox the URL, query the EDR for downstream activity
- ·L4+: containment actions — Suricata is detection-only in this stack; containment routes through firewall/EDR connectors
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/suricata/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
Suricata covers 4 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 Run Suricata on a box that sees your traffic — a SPAN/mirror port, a tap, or inline.
- 2 Enable eve.json output (the structured event log CyberCLI reads).
- 3 Run `cybercli onboard suricata` and point it at the eve.json path.
- 4 Confirm alerts are flowing in the dashboard's Connectors panel.
sudo add-apt-repository ppa:oisf/suricata-stable && sudo apt install suricata
Fully local. Suricata inspects your traffic on your hardware; only the alerts it raises become CyberCLI signals — raw packet data never leaves the box.