Modern IOCs Matching With Suricata

The talk opens with an overview of Suricata as an open-source network security monitoring engine. The speakers explain that it keeps protocol metadata and flow records even when signatures are switched off, and they describe conditional packet capture, which stores full sessions for alerts with deduplication. A flow ID links related protocol logs back to a single alert. They argue that a bare indicator match is weak on its own and needs surrounding context and history.

The middle of the talk covers how IOC matching has moved beyond one signature per indicator. Data sets hold large lists loaded from files or added at runtime through the Unix socket, and a single list can serve several protocol fields. Data sets can also learn values as they are seen, producing a low-cost sightings database for retrospective checks. Flowbits tag matching flows so they can be searched later. The speakers show example queries for newly registered domains, high-entropy names and suspicious downloads, and they present YITE, a Python tool that imports MISP indicators into Suricata and sends sightings back to MISP.

The closing section recommends Suricata's documentation for further reading and stresses that backward-looking searches over stored logs matter as much as real-time alerts. The main takeaway for practitioners is that retained metadata lets a newly published indicator be checked against past traffic. In the audience questions, the speakers said the project depends on signature-based detection and rich network data rather than unsupervised learning.