thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Suricata

An open-source, multithreaded intrusion detection and prevention engine and network security monitoring tool.

Definition

Suricata uses Snort-compatible signatures, performs protocol detection, file extraction and TLS/JA3 logging, and outputs EVE JSON logs. It can run as an IDS, inline IPS or offline PCAP analyzer. It is developed by the Open Information Security Foundation.

Example

Running suricata -r capture.pcap with Emerging Threats rules to find known malware traffic.

Exam tip

Suricata is multithreaded and Snort-rule compatible; Zeek focuses on protocol logging.

Related terms