1. Suricata – The IDS/IPS Engine
- Role: High-performance Intrusion Detection System (IDS) / Intrusion Prevention System (IPS).
- What it does: Inspects network traffic in real time using signature-based rules (like Emerging Threats, Snort rules). It detects known threats: malware C2 traffic, exploit attempts, suspicious patterns, etc.
- Output: Alerts in JSON/EVE format, plus full packet capture (optional).
2. Zeek (formerly Bro) – The Network Analyzer
- Role: A powerful network analysis framework, not just an IDS.
- What it does: Zeek doesn’t rely on signatures. Instead, it extracts rich metadata from network traffic: every connection, HTTP request, DNS query, SSL certificate, file transfer, email, etc.
- Output: Structured, tab-separated logs (conn.log, http.log, dns.log, ssl.log, etc.) that are perfect for hunting and forensics.
Suricata vs. Zeek: Suricata tells you “I found a known bad thing.” Zeek tells you “here’s everything that happened on the network.”
3. Arkime (formerly Moloch) – The Packet Capture & Search
- Role: Large-scale, open-source packet capture and search system.
- What it does: Captures all network traffic to disk (PCAP), indexes sessions, and provides a web UI to search, browse, and export packets.
- Output: A web interface where you can search by IP, port, protocol, string, etc., and instantly view the raw packets.
How They Work Together
| Tool | Primary Function | Key Question It Answers |
|---|---|---|
| Suricata | Threat Detection | “Was there an attack?” |
| Zeek | Metadata & Logging | “What exactly happened?” |
| Arkime | PCAP & Search | “Can I see the raw packets?” |
Typical workflow:
- Suricata fires an alert: “Possible C2 beaconing detected.”
- You pivot to Zeek logs to see the full timeline: the HTTP requests, DNS lookups, connection durations.
- You jump into Arkime to pull the raw PCAP and reconstruct the actual payload.
Common Deployment Pattern
- A network TAP or SPAN port sends a copy of traffic to a sensor.
- The sensor runs Suricata + Zeek + Arkime Capture on the same interface.
- Logs go to Elasticsearch or OpenSearch; Arkime’s viewer connects to the same datastore.
- Analysts use a SIEM (like Elastic Security, Splunk, or Wazuh) to correlate alerts and logs.
