Suricata

v7.0.4Open Information Security Foundation

Multi-threaded rule engine with protocol parsers for HTTP, TLS, DNS, SMB and more. Emits eve.json events a SIEM can hunt across. The range parses rules and replays them against the scenario's authored captures.

Category: Intrusion detection & network monitoring
Package: suricata
Runs on: Linux
Commands: suricata, suricatasc, suricata-update

Rules are parsed and matched against authored capture fixtures. No interface is opened and no packet is captured live.

Install it

The scripts below install the real Open Information Security Foundation package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-suricata.sh

Windows installer (PowerShell)

Install-suricata.ps1

No native Windows build. Use a Linux host in the range, or run it under WSL.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Suricata
```
sudo apt install -y suricata
```

RHEL, Fedora (dnf)

Install Suricata
```
sudo dnf install -y suricata
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Suricata
```
sudo pacman -S --noconfirm suricata
```

Alpine (apk)

Install Suricata
```
sudo apk add suricata
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which suricata
```
Check the version
```
suricata --version
```
The range reports 7.0.4.

Remove it

Take it off again
```
sudo apt remove --purge suricata
```

On Windows

No native Windows build. Use a Linux host in the range, or run it under WSL.

Windows Subsystem for Linux

Install a Linux userland on the Windows host
```
wsl --install -d Ubuntu
```
The upstream project has no native Windows build; WSL is the usual way round it.
Install Suricata inside it
```
wsl sudo apt install -y suricata
```

Inside the range

Tick it on the launch screen
Under Suricata's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y suricata
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Suricata

No lab locks this one on yet — tick it on the launch screen and take it into any scenario.