What's New In Suricata 8: Enhanced Detection And Performance

Peter Manev and Eric Leblond introduce Suricata, the open source network threat detection engine developed since 2007 and owned by a non-profit foundation under the GPL version 2 license. They explain the difficulty of handling a wide variety of traffic and users, from large cloud providers to hobbyists and researchers, while keeping up with very high packet rates. The project ships a major release about every two years, with regular patches in between.

The core of the talk covers what Suricata 8 adds after roughly two years of development. Detection gains more than 100 new keywords, a 38 percent increase over version 7, and transactional rules let one signature match both directions of a stream instead of splitting the logic across separate rules. For threat intelligence, data sets can now hold JSON entries, so an alert carries the matching indicator context into the SIEM rather than a bare hit. The speakers also cover added protocol support such as LDAP, a larger share of code written in Rust including the HTTP and FTP parsers, and Lua scripting that runs inside a sandbox.

They close with a new firewall mode, which lets operators drop flows at chosen protocol stages, and with the use of the engine as a library inside other tools. The talk ends by encouraging users to send feedback, pointing to the documentation, the annual Suricon meeting and training options as ways to get involved.