Skip to content

What's New in Suricata 8: Enhanced Detection and Performance#

hack.lu 2025 digest Program Core pick 21–24 October 2025

Abstract Recording

Eric Leblond, Peter Manev (OISF / Stamus Networks)

Play the recording: What's New in Suricata 8: Enhanced Detection and Performance

  • Why: Suricata underpins a large share of open and commercial NDR deployments. Suricata 8's protocol expansion — notably DNS over HTTPS and LDAP — speaks directly to keeping wire visibility as DNS and directory traffic go encrypted.
  • What: Release overview: new protocol parsers (LDAP, DNS over HTTPS, SIP, SDP, POP3, WebSocket), "transactional rules" that match traffic in both directions with a single signature, 100+ new keywords (entropy matching, domain transform, datasets with JSON context, ENIP, full DNS field matching, enhanced SMTP/EMAIL/FTP), plus performance/security work: vendoring and sandboxed Lua by default and the HTTP parser implemented in Rust. (from abstract only)
  • How: Feature walkthrough with detection-engineering framing; a companion hands-on training at the conference covers the same features with malware PCAP traces.
  • Where applicable: General NDR/IDS deployments — broadly applicable. The DoH and full-DNS-field parsing matters wherever recursive-to-DoH migration has blinded classic DNS monitoring.