Suricata

Network IDS/IPS engine that runs passively and alerts unless explicitly deployed inline.

Provider: default
Kind: Firewall
Category: Security
Official docs: https://docs.suricata.io/en/latest/rule-management/suricata-update.html

Properties · 5 set by this component

property	type	values	required	kind default	this component
captureMethod · component property	enum	af-packet \| pcap \| nfqueue \| netmap \| dpdk	no	af-packet	inherited
defaultAction	enum	allow \| deny	no	—	▸ allow
eveJsonOutput · component property	boolean	—	no	true	inherited
intrusionPrevention	boolean	—	no	—	▸ false
logging	boolean	—	no	—	▸ true
managed	boolean	—	no	false	▸ false
mode · component property	enum	ids \| ips	no	ids	inherited
ruleCount	integer	—	no	—	inherited
ruleSource · component property	string	—	no	et-open	inherited
stateful	boolean	—	no	—	▸ true

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "suricata", component: "suricata" }

Other Firewall products · 35

Cloud Firewallalibaba-cloud-firewallalibabacloudfirewall Network ACLalibaba-network-aclalibabacloudfirewall ECS Security Groupalibaba-security-groupalibabacloudfirewall Network ACLaws-network-aclawsfirewall AWS Network Firewallaws-network-firewallawsfirewall Amazon Route 53 Resolver DNS Firewallaws-route53-dns-firewallawsfirewall Security groupaws-security-groupawsfirewall Microsoft Entra Internet Accessazure-entra-internet-accessazurefirewall Azure Firewallazure-firewallazurefirewall Network Security Groupazure-network-security-groupazurefirewall Network security perimeterazure-network-security-perimeterazurefirewall Cloudflare DNS Firewallcloudflare-dns-firewallcloudflarefirewall Cloudflare Gatewaycloudflare-gatewaycloudflarefirewall Cloudflare Network Firewallcloudflare-network-firewallcloudflarefirewall Generic firewallfirewallfirewall Firewall appliancefirewall-appliancefirewall Fortinet FortiGatefortigatefirewall MikroTik RouterOSmikrotik-routerosfirewall nftablesnftablesfirewall OPNsenseopnsensefirewall Palo Alto Networks NGFWpalo-alto-ngfwfirewall pfSensepfsensefirewall Snortsnortfirewall VyOSvyosfirewall DigitalOcean Cloud Firewallsdigitalocean-cloud-firewalldigitaloceanfirewall Cloud IDSgoogle-cloud-idsgcpfirewall Cloud NGFWgoogle-cloud-ngfwgcpfirewall Secure Web Proxygoogle-secure-web-proxygcpfirewall IBM Cloud Hardware Firewallibm-firewallibmfirewall VPC Security Groupibm-security-groupibmfirewall NetworkPolicyk8s-network-policyk8sfirewall Network Firewalloci-network-firewallocifirewall Network Security Groupoci-network-security-groupocifirewall Security Listoci-security-listocifirewall Security Groupoutscale-security-groupoutscalefirewall

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Suricata: network IDS/IPS and network security monitoring engine. It runs passively in
3# IDS mode unless explicitly set up inline (NFQUEUE or af-packet IPS), so nothing is
4# dropped out of the box; rules are fetched separately with suricata-update (ET Open).
5schemaVersion: "1"
6type: "component"
7id: "suricata"
8kind: "firewall"
9provider: "default"
10docs: "https://docs.suricata.io/en/latest/rule-management/suricata-update.html"
11defaults:
12  managed: false
13  defaultAction: "allow"
14  stateful: true
15  logging: true
16  intrusionPrevention: false
17properties:
18  mode:
19    type: "enum"
20    values: ["ids", "ips"]
21    default: "ids"
22  captureMethod:
23    type: "enum"
24    values: ["af-packet", "pcap", "nfqueue", "netmap", "dpdk"]
25    default: "af-packet"
26  ruleSource:
27    type: "string"
28    default: "et-open"
29  eveJsonOutput:
30    type: "boolean"
31    default: true

The same page as markdown, for an agent: /catalogue/components/suricata.md