Software update: Suricata 2.0

Version 2.0 of Suricata has been released. Suricata is an open source network intrusion detection system (IDS), intrusion prevention system (IPS), and network security monitoring engine. It can be used to monitor network traffic and alert a system administrator if anything suspicious is detected. Development is overseen by the Open Information Security Foundation, with support from the community and various manufacturers. The main change in version 2.0 is Eve, a fully op json based logging system. Eve can, among other things, with log stash are used to display information graphically weather to to give. The complete changelog for version 2.0 can be found below.

Notable new features, improvements and changes

• Eve log, all JSON event output for alerts, HTTP, DNS, SSH, TLS and files. Written by Tom Decanio of nPulse Technologies
• NSM run mode, where detection engine is disabled. Development supported by nPulse Technologies
• Various scalability improvements, clean ups and fixes by Ken Steel of Tilera
• Add –set commandline option to override any YAML option, by Jason Ish of Emulex
• Several fixes and improvements of AF_PACKET and PF_RING
• ICMPv6 handling improvements by Jason Ish of Emulex
• Alerting about PCIe bus (Tilera only), by Ken Steel of Tilera
• Feature #792: DNS parser, logger and keyword support, funded by Emerging Threats
• Feature #234: add option disable/enable individual app layer protocol inspection modules
• Feature #417: ip fragmentation time out feature in yaml
• Feature #1009: Yaml file inclusion support
• Feature #478: XFF (X-Forwarded-For) support in Unified2
• Feature #602: availability for http.log output – identical to apache log format
• Feature #813: VLAN flow support
• Feature #901: VLAN Defrag Support
• Features #814, #953, #1102: QinQ VLAN handling
• Feature #751: Add invalid packet counter
• Feature #944: detect nic offloading
• Feature #956: Implement IPv6 reject
• Feature #775: libhtp 0.5.x support
• Feature #470: Deflate support for HTTP response bodies
• Feature #593: Lua flow vars and flow ints support
• Feature #983: Provide rule support for specifying icmpv4 and icmpv6
• Feature #1008: Optionally have http_uri buffer start with uri path for use in proxied environments
• Feature #1032: profiling: per keyword stats
• Feature #878: add storage api

Logstash Kibana fed with information from Suricata with json output.