Network detection and context
Combine network detections with connection and protocol context. Suricata and Zeek have complementary roles in an appropriately placed network sensor.
- Network detections. Suricata evaluates visible traffic using configured detection rules.
- Connection context. Zeek produces structured records describing observed network activity.
- Protocol visibility. Use available DNS, HTTP, TLS, and other metadata when visible to the sensor.
- Joined investigations. Relate a network observation to the affected device and case.
Approved sensor placement, traffic visibility, tuning, retention, and privacy review. Encrypted traffic and unseen network paths limit the evidence available.