repowiseoisf/suricata

oisf / suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

C★ 6,700
Use in your agentAsk this codebase

github.com/oisf/suricataIndexed at a5ec441Up to date with upstream

What is suricata?

suricata is a network intrusion detection system, intrusion prevention system and network security monitoring engine. It consumes live network traffic, signatures, rules and protocol analysis inputs, then produces alerts, events and related telemetry. The project is primarily written in C, with additional C++, Rust, shell and Python code.

Written by a model from the README and the source

1,680 files and 33,027 symbols in 13 modules, led by C (646 files) and C++ (590).

Start reading

Code health

6.7out of 10Fair

This codebase scores 6.7 out of 10 for code health, which we rate fair. It also scores maintainability 5.5 and static performance 9.9 out of 10. The three are scored separately and never blended into one number. Risk is concentrated, as it usually is: 54 of 1,680 files are git hotspots, and they average 3.3 — which is where the fixes pay off most.

Full health report

Use oisf/suricata in your agent

Point Claude Code, Cursor, Codex or VS Code at this repository. Your agent gets the index this page is built from: cited answers, callers, history and health for any file.

  1. 1.In Claude, open Customize → Connectors, click +, then Add custom connector. On a Team or Enterprise plan an owner adds it first under Organization settings → Connectors.
  2. 2.Paste the server URL below as the Remote MCP server URL, then click Add.
  3. 3.Click Connect. A Repowise sign-in window opens. Approve access.
  4. 4.Repowise's tools are now available in your Claude chats.

Connect with one click. Sign in with Repowise (OAuth), no API key to copy. Works in Claude on the web, desktop, and mobile.

Docs
bash
https://api.repowise.dev/mcp/oisf/suricata
Editors need an API key: sign in to create one.Sign in to connect

This repo is public, so anyone with a Repowise account and an API key can connect.

Try asking

  • get_overview()
  • get_answer("how is suricata put together?")
  • get_why("why is suricata structured this way?")

Explore suricata

Key features of suricata

  • Suricata provides network intrusion detection system capabilities.
  • Suricata provides intrusion prevention system capabilities.
  • Suricata provides network security monitoring capabilities.
  • Suricata runs build tests and regression tests as part of its quality assurance process.
  • Suricata supports traffic replay testing, pcap-based fuzz testing and output validation of logging.

How oisf/suricata works

Network traffic and analysis inputs enter the engine through runtime and library entry points, including examples/lib/live/main.c and examples/lib/simple/main.c. The C engine core in src processes runtime events through its analysis pipeline and turns them into detection and alert outcomes. The detection parser in src/detect-parse.c handles detection-related parsing. Protocol processing includes rust/src/http2/http2.rs for HTTP/2 and rust/src/nfs/nfs.rs for NFS. The engine also includes application-layer protocol handling in src/app-layer-smtp.c and src/app-layer-ftp.c. Outputs include alerts, events and network security monitoring telemetry for operators and downstream automation.

The codebase has 1,680 files and 33,027 symbols in 13 modules, led by C, C++ and Rust. Code health is 6.7 out of 10, rated fair.

oisf/suricata FAQ

What is suricata?

suricata is a network intrusion detection system, intrusion prevention system and network security monitoring engine. It analyzes network traffic and produces alerts, events and related telemetry.

How does suricata work?

suricata consumes live network traffic, signatures, rules and protocol analysis inputs, then processes them through an analysis pipeline. The engine produces detection outcomes, alerts, events and network security monitoring telemetry.

What language is suricata written in?

suricata is primarily written in C. The codebase also includes C++, Rust, shell and Python.

How is the suricata code organized?

suricata places its main engine code in src and Rust components in rust. The repository also includes scripts, qa, examples, plugins, ebpf and documentation in doc.

When should I use suricata?

Use suricata when you need network intrusion detection, intrusion prevention or network security monitoring. It analyzes traffic and produces alerts, events and related telemetry.

What license does suricata use?

suricata uses the GPL-2.0 license.

The summary, features and answers on this page are written by a model from the README and the source, and refreshed with each index.

About this page

Get a page like this for your own codebase

Repowise built this map of oisf/suricata from its source and git history. It parses every symbol, draws the dependency graph, scores each file's health from complexity, duplication, coverage and churn, finds hotspots and owners in the history, and writes documentation for every module. Your coding agent reads the same index over MCP, so its answers cite real files.

Index your repo freeSee how Repowise worksFree for 2 public repos, with a page like this one.

Prefer local? pip install repowise && repowise init indexes your own checkout, no account needed.