# Configuring Suricata For Network Monitoring

Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill configuring-suricata-for-network-monitoring -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill configuring-suricata-for-network-monitoring -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill configuring-suricata-for-network-monitoring -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill configuring-suricata-for-network-monitoring -g -a gemini-cli -y`

## Description

Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Configuring Suricata for Network Monitoring

## When to Use

- Deploying a high-performance IDS/IPS capable of multi-threaded packet processing for 10+ Gbps network links
- Monitoring network traffic with protocol-aware inspection for HTTP, TLS, DNS, SMB, and other protocols
- Generating structured EVE JSON logs for direct SIEM ingestion without custom parsers
- Running in inline (IPS) mode to actively block malicious traffic at network choke points
- Combining signature-based detection with protocol anomaly detection and file extraction

**Do not use** as a standalone security solution without complementary controls, for encrypted traffic inspection without TLS decryption capabilities, or on systems with insufficient CPU/memory for the expected traffic volume.

## Prerequisites

- Suricata 7.0+ installed from PPA or source (`suricata --build-info`)
- Network interface on a span port, tap, or inline bridge for traffic capture
- AF_PACKET or DPDK support for high-performance packet capture
- Emerging Threats Open or Pro ruleset subscription (or Snort Talos rules via oinkcode)
- suricata-update tool for automated rule management
- Elasticsearch/Kibana or Splunk for log analysis and visualization

## Workflow

### Step 1: Install Suricata and Dependencies

```bash
# Install from PPA (Ubuntu/Debian)
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt update
sudo apt install -y suricata suricata-update jq

# Verify installation
suricata --build-info | grep -E "Version|AF_PACKET|NFQueue"

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/configuring-suricata-for-network-monitoring/SKILL.md