Intrusion detection

    Suricata IDS: see the attack that got past the firewall

    FlowPro NG processes Suricata IDS events and shows who is trying what on your network: scans, exploits, malware traffic and suspicious DNS and TLS connections. All on your own server, with one view across multiple sensors.
    Try it free for 14 daysOnline demo
    flowpro.local/ids
    Suricata IDS overview in FlowPro NG

    A firewall lets through what is allowed. It does not check what hides inside that traffic.

    An attack on a web server over port 443, an infected workstation calling home to its command server, or an exploit of a known vulnerability all look like ordinary allowed traffic to a firewall. Only the packet content gives them away.

    Suricata is a proven open-source IDS, but on its own it only produces a large file of events. FlowPro NG turns them into a view that shows what matters, where the attack comes from and which devices it affects.

    What you get

    Intrusion detection (IDS) in FlowPro NG

    Alerts with severity and trend

    Alert count, unique signatures and source IPs compared with the previous period. Severity is derived from the rule category, so critical alerts are right at the top.

    DNS, HTTP, TLS and FTP in detail

    Which domains your hosts query, which URLs and methods they use, which TLS versions and cipher suites. Click a domain, hostname or SNI to open a detail with timeline and source IPs.

    JA3 hunting and host insights

    The TLS client fingerprint (JA3) helps you find the same malware on other machines. The host view sums up a single host's alerts, connections and protocols in one place.

    Fewer false positives

    The noisy-rule helper shows the signatures that generate the most alerts and makes them easy to switch off. ET Open rules update automatically on the sensor every day.

    Multiple sensors in one view

    One sensor at the network edge, another in the server room or a branch office. All send data to one FlowPro NG and you switch between sensors with a single selector.

    GeoIP map, anomalies and export

    The map shows where attacks come from. The Anomalies, Flows and Protocols tabs complete the picture of the traffic. Export results to CSV, JSON or PDF, up to 10,000 records at a time.

    • Suricata
    • EVE JSON
    • ET Open
    • Elastic Agent
    • Elasticsearch
    • SPAN
    • TZSP
    • MikroTik
    • DNS
    • HTTP
    • TLS
    • FTP
    • JA3
    • GeoIP
    • MITRE ATT&CK

    How it works

    Up and running in a few steps

    1. 01

      Prepare a sensor

      Run the install script on a Linux server at the network edge. It installs Suricata, sets the monitored interface and your network (HOME_NET) and downloads the ET Open rules.

    2. 02

      Feed traffic to the sensor

      The sensor watches traffic directly on the gateway or receives a copy from a mirrored port (SPAN). From a MikroTik router, traffic can also be streamed over TZSP using the Packet Sniffer tool.

    3. 03

      See data within two minutes

      Elastic Agent on the sensor ships the EVE JSON events to FlowPro NG. They appear in the IDS module within 1–2 minutes and alerts go straight to the Event Center.

    FAQ

    Frequently asked questions

    What is an IDS?

    An IDS (intrusion detection system) inspects network traffic against rules and alerts you when it finds a known attack, malware communication or unusual protocol behavior. FlowPro NG uses Suricata for this.

    What is the difference between IDS and IPS?

    An IDS watches traffic and raises alerts, an IPS sits inline and drops suspicious packets. FlowPro NG works as an IDS: Suricata analyzes traffic passively and blocks nothing, so a sensor failure does not affect the network. You respond to alerts manually, or automatically with playbooks in the Enterprise license.

    Where should I place the Suricata sensor?

    Usually on the internet gateway, or on a server that receives a copy of the traffic from a mirrored switch port. If the gateway is a MikroTik router, traffic can be streamed over TZSP to a separate Suricata server. You can run several sensors, for example one per branch.

    Can the IDS see into encrypted traffic?

    It does not decrypt HTTPS content. From TLS connections it still sees the server name (SNI), TLS version, cipher suite and JA3 client fingerprint, which is often enough to spot malware or suspicious destinations. Unencrypted protocols such as DNS, HTTP and FTP are analyzed in full.

    Does any data leave my network?

    No. The sensor sends events only to your FlowPro NG server, where they are stored. Only the license check and technical instance status leave the network, never traffic content or alerts.

    Related solutions

    Network anomaly detection17 detections over network flows every minute: port scans, floods, data exfiltration, beaconing, lateral movement, tunnels.NetFlow analysisWho talks to whom on your network, how much and where. NetFlow, IPFIX and sFlow from routers and firewalls, no traffic mirroring.HoneypotA decoy that draws attackers in. See who attacks, which passwords they try and which commands they run, before they reach your real servers.
    How FlowPro NG compares to Wazuh, Elastic, Splunk and Flowmon

    Try it on your own network

    The 14-day Enterprise trial unlocks every module. You install it on your own server, no credit card needed.

    Start Free TrialOnline Demo