opensearch-project / opensearch-project/security-analytics
[FEATURE] integration with suricata
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 111
- Forks
- 111
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 13
Description
Is your feature request related to a problem?
Suricata is one of the largest open source IDS systems and is often used in combination with the ELK stack. It would be nice to be able to feed this data into opensearch and then analyse it with dashboards and / or intelligent detection rules to detect attacks and anomalies.
What solution would you like?
Implement rules / anomaly detection based on the suricata data / alerts. Data is usually fed through logstash.
Example dashboards: https://github.com/StamusNetworks/KTS7
What alternatives have you considered?
None - this is one of the most used solutions and we have been using it for years. Large companies and organisations are depending on Suricata.
Do you have any additional context?
Add any other context or screenshots about the feature request here.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The request covers Suricata alerts, Logstash ingestion, OpenSearch dashboards, and intelligent detection rules, with KTS7 provided as an example. Start by clarifying the supported Suricata data and ingestion path, then define the dashboard, rule, and anomaly-detection scope. Done should mean the agreed integration can feed Suricata data into OpenSearch for the requested analyses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elasticsearch
- Domain
- analytics, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100