oisf / suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
github.com/oisf/suricataIndexed at a5ec441Up to date with upstream
About this codebase
Suricata is a network IDS, IPS and NSM engine that consumes live network traffic and analysis inputs (e.g., signatures/rules and protocol parsers), runs detection and inspection through its analysis pipeline, and produces alerts, events, and related NSM telemetry for operators and downstream automation. It is built by the OISF and the Suricata community, with the project’s QA flow emphasizing regression and build testing to confirm existing features continue to work as the engine evolves.
Written by gpt-5.4-nano from the index
1,680 files and 33,027 symbols in 13 modules, led by C (646 files) and C++ (590).
Code health
This codebase scores 6.7 out of 10 for code health, which we rate fair. It also scores maintainability 5.5 and static performance 9.9 out of 10. The three are scored separately and never blended into one number. Risk is concentrated, as it usually is: 54 of 1,680 files are git hotspots, and they average 3.3 — which is where the fixes pay off most.
Do next
1 thing worth doing in the week to Sep 17, the last indexed commit, 1 of them now.
Now
- Critical
Clean up what this week's commits left: 35 serious findings in 6 files
6 commits in the last 7 days added or worsened them, and they are still open. Start with
rust/src/nfs/nfs.rs, which has 9 critical.- serious findings
- 35
- critical
- 11
- files
- 6
Medium effort
Improve what Repowise can see
Add a test coverage report
Without one, Repowise cannot tell tested code from untested code, so every test-related action says “unknown”.
- line coverage
- Unknown, no report
Small effort
Use oisf/suricata in your agent
Point Claude Code, Cursor, Codex or VS Code at this repository. Your agent gets the index this page is built from: cited answers, callers, history and health for any file.
https://api.repowise.dev/mcp/oisf/suricataOne command, run anywhere. Adds the server to your local Claude Code config.
Docsclaude mcp add --transport http repowise https://api.repowise.dev/mcp/oisf/suricata \ --header "Authorization: Bearer rw_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
This repo is public, so anyone with a Repowise account and an API key can connect.
Try asking
- get_overview()
- get_answer("how is suricata put together?")
- get_why("why is suricata structured this way?")
Prefer local? pip install repowise && repowise init indexes your own checkout, no account needed.
Go deeper
- OverviewEverything the index found, what changed this week, commits and decisions.
- DocumentationModule-by-module documentation, 3,355 pages, 28 written by a model.
- ArchitectureDependency graph, layers and third-party dependencies.
- Code healthEvery file's score, the findings behind it, tests and refactoring plans.
- CommitsEach commit's effect on code health, with agent provenance.
- ContributorsWho owns what, and where one person holds most of the knowledge.
- DecisionsArchitectural decisions mined from commits and pull requests.
- Ask this codebaseSign inGrounded answers over the indexed code.
Maintain this repo? Claim the page
Sign in with GitHub and we check that you are an admin or maintainer of oisf/suricata. Then add a badge to the README that links readers here.
Use this repo from Claude or ChatGPT
Add this URL as a custom connector and sign in with repowise when asked. No API key to copy.
https://api.repowise.dev/mcp/oisf/suricataFor maintainers
Add a badge to your README
Every badge is public, cached, and updates on its own after every index. Nothing to install.
Repowise badge
Links to this page, with no score on it. Adding it also re-indexes the repo every week.
[](https://repowise.dev/repo/oisf/suricata?src=badge_wiki)Code health badge
The repo's health score out of 10, from the latest index.
[](https://repowise.dev/repo/oisf/suricata?src=badge_health)Code health card
A larger card with the score, its change since the last index, and when it was measured. The HTML version follows the reader's light or dark theme.
[](https://repowise.dev/repo/oisf/suricata?src=badge_card)What is suricata?
suricata is a network intrusion detection system, intrusion prevention system and network security monitoring engine. It consumes live network traffic, signatures, rules and protocol analysis inputs, then produces alerts, events and related telemetry. The project is primarily written in C, with additional C++, Rust, shell and Python code.
Written by a model from the README and the index
Key features of suricata
- Suricata provides network intrusion detection system capabilities.
- Suricata provides intrusion prevention system capabilities.
- Suricata provides network security monitoring capabilities.
- Suricata runs build tests and regression tests as part of its quality assurance process.
- Suricata supports traffic replay testing, pcap-based fuzz testing and output validation of logging.
How oisf/suricata works
Network traffic and analysis inputs enter the engine through runtime and library entry points, including examples/lib/live/main.c and examples/lib/simple/main.c. The C engine core in src processes runtime events through its analysis pipeline and turns them into detection and alert outcomes. The detection parser in src/detect-parse.c handles detection-related parsing. Protocol processing includes rust/src/http2/http2.rs for HTTP/2 and rust/src/nfs/nfs.rs for NFS. The engine also includes application-layer protocol handling in src/app-layer-smtp.c and src/app-layer-ftp.c. Outputs include alerts, events and network security monitoring telemetry for operators and downstream automation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community. This page is a map of the oisf/suricata repository, written primarily in C, rebuilt from the source each time it is indexed. Repowise parses every symbol, computes a dependency graph, scores per-file code health from complexity, duplication, test coverage and churn, mines git history for hotspots and ownership, and lifts the architectural decisions into documentation you can read here or query through MCP.
The codebase has 1,680 files and 33,027 symbols in 13 modules, led by C, C++ and Rust. Code health is 6.7 out of 10, rated fair.
Use the links above to open each view, or connect this repository to your agent for grounded answers inside Claude, Cursor, Codex or VS Code.
oisf/suricata FAQ
What is suricata?
suricata is a network intrusion detection system, intrusion prevention system and network security monitoring engine. It analyzes network traffic and produces alerts, events and related telemetry.
How does suricata work?
suricata consumes live network traffic, signatures, rules and protocol analysis inputs, then processes them through an analysis pipeline. The engine produces detection outcomes, alerts, events and network security monitoring telemetry.
What language is suricata written in?
suricata is primarily written in C. The codebase also includes C++, Rust, shell and Python.
How is the suricata code organized?
suricata places its main engine code in src and Rust components in rust. The repository also includes scripts, qa, examples, plugins, ebpf and documentation in doc.
When should I use suricata?
Use suricata when you need network intrusion detection, intrusion prevention or network security monitoring. It analyzes traffic and produces alerts, events and related telemetry.
What license does suricata use?
suricata uses the GPL-2.0 license.
Answers written by a model from the README and the index