Raid on Inliniac

Suricata development training update

Wed, 05 Sep 2012 18:21:42 +0000

The Suricata development training at RAID 2012 next week is going to happen, so please all RSVP. It’s free!

If you’re planning to attend, please let me know what topics you are interested in. We have core devs in the room, so we can go hardcore on everything from the threading to packet capture to CUDA to pattern matching… also more straightforward stuff like extending Suricata with new keywords, log modules, etc.

Suricata development training

Thu, 12 Jul 2012 23:13:18 +0000

We’re considering to offer a Suricata development training day around the next OISF brainstorm meeting. That would be in Amsterdam around the RAID conference, in early September.

Topics we could cover:

- code/development overview - create/extend detect module - create/extend output module - app layer module - proto detection - …

The training would probably be free as it’s an excercise for us as well, so we’d just want honest feedback in return :)

Suricata 1.3 released

Fri, 06 Jul 2012 16:06:52 +0000

Today, almost half a year after the last “stable” release, we released Suricata 1.3. I think this release is a big step forward with regard to maturity of Suricata. Performance and scalability have been much improved, just like accuracy and stability.

The official announcement can be found on the OISF site

In the last 6 months a lot of code has been changed:

384 files changed, 44332 insertions(+), 18478 deletions(-)

RAID 2011 Thoughts

Sat, 24 Sep 2011 16:09:24 +0000

The last few days I’ve been at the Recent Advances in Intrusion Detection (RAID) conference in California. Overall it has been a very pleasant and interesting experience. The nice California weather was certainly helping a lot!

I’ve seen all talks and some were very interesting. However, being a Suricata IDS developer, I was not just interested in research for the hell of it, but I was actively scouting for ideas we could implement into Suricata. In this respect the conference was highly disappointing. Although with some of the talks I thought the idea was applicable in general security, like Erik Bosmans high speed memory tainting detection, I found nothing like that for NIDS.