24
IDS (Suricata)
IDS (Intrusion Detection System) — overview
The IDS module uses Suricata — an open-source network intrusion detection system (NIDS). It analyzes network traffic in real-time and detects intrusion attempts, malware, exploit attempts, and protocol anomalies.
Summary overview
The top of the page displays stat cards with trends compared to the previous period:
- •Total alert count — how many IDS rules were triggered
- •Unique signatures — number of different types of detected threats
- •Unique source IPs — from how many different addresses suspicious activities originate
- •Critical alerts — number of alerts with the highest severity
Trending statistics
Each stat card displays a trend compared to the previous comparable period. The system automatically compares the current period with the previous one:
| Current range | Comparison period |
|---|---|
| 1 hour | Previous 1 hour |
| 6 hours | Previous 6 hours |
| 24 hours | Previous 24 hours |
| 7 days | Previous 7 days |
| 30 days | Previous 30 days |
Severity derivation
The Suricata EVE JSON format does not contain a severity field. FlowPro NG derives severity automatically from the alert category:
| Severity | Categories (examples) |
|---|---|
| Critical | Attempted Admin Privilege Gain, Successful Admin Privilege Gain |
| High | A Network Trojan was Detected, Malware Command and Control Activity |
| Medium | Potentially Bad Traffic, Attempted Information Leak |
| Low | Not Suspicious Traffic, Generic Protocol Command Decode |
Timeline and top alerts
Timeline
The bar chart displays the distribution of IDS alerts over time. Color coding corresponds to severity (critical, high, medium, low).
Top alerts
Table of the most frequent IDS signatures sorted by occurrence count. It shows the rule name, category, severity, and count. Clicking on a signature displays a filtered list of alerts.
Searching and filtering
IDS alerts can be searched and filtered by:
- •Text — search in signature descriptions and categories
- •IP address — exact match or CIDR range (e.g. 192.168.1.0/24)
- •Severity — filter by severity
- •Time range — period (1h, 6h, 24h, 7d, 30d)
Detail views (Drilldown)
The IDS module offers three specialized drilldown views for deeper analysis. Clicking on a row in the respective table opens the detail:
DNS Detail
Clicking on a DNS domain in the table opens a detail with:
- •Domain query timeline — chart of DNS query frequency over time
- •Query type breakdown — A, AAAA, MX, TXT, CNAME, etc.
- •Source IPs — who queried the domain
- •Raw events — table of raw DNS events
HTTP Detail
HTTP traffic analysis for a specific hostname:
- •Request timeline — HTTP traffic volume over time
- •Top URL paths — most frequently accessed paths
- •HTTP methods — distribution of GET/POST/PUT/DELETE
- •Status codes — successful vs. error responses
TLS Detail
TLS/SSL traffic analysis by SNI (Server Name Indication):
- •Connection timeline — TLS handshake volume over time
- •TLS versions — distribution of TLS 1.2 vs. 1.3
- •Cipher suites — used cipher suites
- •Source IPs — who was connecting
Geographic visualization
The map displays the geographic location of IDS alert source IP addresses. The size of the dot corresponds to the number of alerts from the given location. Hovering over a dot shows details — IP addresses, counts, and alert types.
Export
IDS data can be exported in three formats:
| Format | Description | Max. records |
|---|---|---|
| CSV | Tabular format for Excel | 10 000 |
| JSON | Machine-readable format | 10 000 |
| Formatted report for management | 10 000 |
Export uses search_after pagination for reliable browsing of large data volumes.