Suricata 8 - shaping the future of network detection and prevention#

Eric Leblond, Peter Manev (OISF / Stamus Networks)

• Why: Suricata 8 is two years of work (160K lines inserted) and materially changes what the engine can do — including two new deployment modes that signal where open-source network security is heading.
• What: Contributor-led overview of the release: 107 new rule keywords (a 38% increase, under the motto "if you log it, you can use it in a rule") for LDAP, MIME/email, DNS, SMTP, FTP, TLS, WebSocket, and DoH; transactional rules that match both stream directions in one signature (fixing a long-standing false-negative class); and datasets with JSON context so IoC matches carry attribution instead of bare values.
• How: New protocol decoders (WebSocket, LDAP, ARP, DoH/DoH2, SIP over TCP, SDP, POP3, mDNS); 27% of the codebase is now Rust (libhtp built-in and no longer a dependency, plus FTP, ENIP, MIME); Lua 5.4 vendored and sandboxed. Two structural additions: a firewall runmode (suricata --firewall, drop rules keyed on e.g. JA4 hashes — AWS reportedly runs it this way) and Suricata-as-a-library, where embedders bring their own packets/threads and register parsers, loggers, and keywords at runtime.
• Where applicable: NDR/IPS vendors, appliance builders, and any SOC running high-volume monitoring (100G is described as common, 400G on a single server as achievable). The library mode is the one to watch for product people — it changes the build-vs-embed calculus for detection engines.