# Install suricata with Homebrew, apk, apt, dnf, MacPorts, Nix, zypper Network IDS, IPS, and security monitoring engine. Version 8.0.6 via Homebrew; verified 2026-07-08. ## Install ```sh sudo av install brew:suricata ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install suricata ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install suricata ``` Evidence: MacPorts ports tree: net/suricata/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add suricata ``` Evidence: Alpine Linux edge package indexes: suricata from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install suricata ``` Evidence: Debian stable package indexes: suricata from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install suricata ``` Evidence: Fedora Rawhide package metadata: suricata from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#suricata ``` Evidence: nixpkgs package indexes: pkgs/by-name/su/suricata/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - zypper (92%): ```sh sudo zypper install libsuricata8_0_5 ``` Evidence: openSUSE Tumbleweed package metadata: libsuricata8_0_5 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:suricata - **Package manager:** Homebrew - **Package manager page:** - **Version:** 8.0.6 - **Source summary:** Network IDS, IPS, and security monitoring engine - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-2.0-only - **Source archive:** - **Last updated:** 2026-07-08T03:17:14Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - suricata (cli) - suricata-update (cli) - suricatactl (cli) - suricatasc (cli) - suricata (alias) - suricata-update (alias) - suricatactl (alias) - suricatasc (alias) ## Dependencies - jansson - libmagic - libnet - libyaml - lz4 - pcre2 - python@3.14 ## Build dependencies - pkgconf - rust ## Uses from macOS - libpcap ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 8.0.6 - Package-manager updated: 2026-07-08 - Local data: ok - Upstream repository: https://suricata.io - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage Suricata is an open-source network IDS, IPS, and network security monitoring engine developed by the Open Information Security Foundation. In package-manager culture it is a serious operational tool: installed from distro repositories, PPAs, source tarballs, and service packages, then fed rules and packet traffic. ### Project history Suricata's official timeline traces the first code to Victor Julien and Matt Jonkman in 2007, with William Metcalf joining shortly afterward. The first public beta arrived on New Year's Eve 2009, followed by the founding of OISF and the Suricata 1.0 release on March 1, 2010. The project grew around an open foundation model, training, conferences, and recurring stable release lines. Official documentation describes Suricata as a high-performance IDS, IPS, and network security monitoring engine owned by a community-run non-profit foundation and developed by OISF. ### Adoption history Suricata is packaged broadly across Unix-like systems. The input package facts list Homebrew, Debian, Ubuntu, Fedora, Alpine, Arch, MacPorts, Nix, and openSUSE names; official download pages also publish source releases, Windows installers, Ubuntu PPA channels, and RPM packages. Community adoption is also visible in OISF's timeline: public training began in 2013, SuriCon began in 2015, and later SuriCon events drew international users, developers, vendors, and security teams. ### How it is used Suricata is typically configured through `suricata.yaml`, run as a packet inspection service or command-line tool, and paired with rule management through `suricata-update`. The quickstart walks users through choosing interfaces, editing `/etc/suricata/suricata.yaml`, installing rules, restarting the service, and reading EVE JSON output. ### Why package nerds care Suricata matters to package nerds because it sits at the intersection of kernel packet capture, distro service management, ruleset updates, YAML configuration, JSON logs, and fast C/Rust-ish systems engineering. Installing the package is only the start; the interesting work is wiring rules, interfaces, logs, capabilities, and updates into a reproducible host setup. ### Timeline - 2007: First Suricata code begins, according to the official timeline. - 2009: First public beta release occurs on New Year's Eve. - 2010: OISF is founded and Suricata 1.0 is released. - 2013: First public in-person Suricata training takes place. - 2015: First SuriCon is held. - 2025: Suricata 8.0.0 is released. - 2026: Official download page lists Suricata 8.0.5 and 7.0.16 as stable releases. ### Related projects - Suricata is commonly compared or deployed alongside IDS/IPS and network-monitoring ecosystems such as Snort-style rules, Emerging Threats/Open rulesets, Zeek-style monitoring, packet capture tooling, SIEM pipelines, and JSON log processors such as jq. ### Sources - - - - - input source_facts.package-manager ## Security Notes No matching local secret-handling manifest was found for suricata. Nucleus package metadata is still published here so future coverage has a stable package URL. ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: suricata.yaml, /etc/suricata/suricata.yaml, /usr/local/etc/suricata/suricata.yaml ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** suricata - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Debian apt - suricata - 1:7.0.10-1+deb13u4: normalized package name match | Debian stable package indexes: suricata from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Next Generation Intrusion Detection and Prevention Tool | https://suricata.io - Nix - suricata: normalized package name match | nixpkgs package indexes: pkgs/by-name/su/suricata/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - suricata - 1:7.0.3-1build3: normalized package name match | Ubuntu 24.04 LTS package indexes: suricata from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Next Generation Intrusion Detection and Prevention Tool | https://suricata.io - apk - suricata - 8.0.3-r0: normalized package name match | Alpine Linux edge package indexes: suricata from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | High performance Network IDS, IPS and Network Security Monitoring engine | https://suricata.io/ - apk - suricata-doc - 8.0.3-r0: normalized package name match | Alpine Linux edge package indexes: suricata-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | High performance Network IDS, IPS and Network Security Monitoring engine (documentation) | https://suricata.io/ - apk - suricata-openrc - 8.0.3-r0: normalized package name match | Alpine Linux edge package indexes: suricata-openrc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | High performance Network IDS, IPS and Network Security Monitoring engine (OpenRC init scripts) | https://suricata.io/ - dnf - suricata - 8.0.5-1.fc45: normalized package name match | Fedora Rawhide package metadata: suricata from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Intrusion Detection System | https://suricata.io/ - zypper - libsuricata8_0_5 - 8.0.5-1.1: normalized package name match | openSUSE Tumbleweed package metadata: libsuricata8_0_5 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Open Source Next Generation Intrusion Detection and Prevention Engine Library | https://www.openinfosecfoundation.org/ - zypper - suricata - 8.0.5-1.1: normalized package name match | openSUSE Tumbleweed package metadata: suricata from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Open Source Next Generation Intrusion Detection and Prevention Engine | https://www.openinfosecfoundation.org/ - zypper - suricata-devel - 8.0.5-1.1: normalized package name match | openSUSE Tumbleweed package metadata: suricata-devel from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Development files for the Suricata engine library | https://www.openinfosecfoundation.org/ - MacPorts - suricata: normalized package name match | MacPorts ports tree: net/suricata/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 - Debian apt - suricata-update - 1.3.4-1: installed executable or alias match | Debian stable package indexes: suricata-update from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | tool for updating Suricata rules | https://github.com/OISF/suricata-update - Ubuntu apt - suricata-update - 1.3.0-2: installed executable or alias match | Ubuntu 24.04 LTS package indexes: suricata-update from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | tool for updating Suricata rules | https://github.com/OISF/suricata-update ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [libnet](https://www.automicvault.com/pkg/brew/libnet/) - Runtime dependency declared by Homebrew. - [lz4](https://www.automicvault.com/pkg/brew/lz4/) - Runtime dependency declared by Homebrew. - [pcre2](https://www.automicvault.com/pkg/brew/pcre2/) - Runtime dependency declared by Homebrew. - [python@3.14](https://www.automicvault.com/pkg/brew/python-3-14/) - Runtime dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [rust](https://www.automicvault.com/pkg/brew/rust/) - Build dependency declared by Homebrew. - [arpoison](https://www.automicvault.com/pkg/brew/arpoison/) - Shares av.db curated category or tags: cli, network-security, security. - [ettercap](https://www.automicvault.com/pkg/brew/ettercap/) - Shares av.db curated category or tags: cli, network-security, security. - [fragroute](https://www.automicvault.com/pkg/brew/fragroute/) - Shares av.db curated category or tags: cli, network-security, security. - [rshijack](https://www.automicvault.com/pkg/brew/rshijack/) - Shares av.db curated category or tags: cli, network-security, security. - [fwknop](https://www.automicvault.com/pkg/brew/fwknop/) - Shares av.db curated category or tags: cli, network-security, security. - [zeek](https://www.automicvault.com/pkg/brew/zeek/) - Shares av.db curated category or tags: cli, network-security, security, security-monitoring. - [bettercap](https://www.automicvault.com/pkg/brew/bettercap/) - Shares av.db curated category or tags: cli, network-security, security. - [killswitch](https://www.automicvault.com/pkg/brew/killswitch/) - Shares av.db curated category or tags: cli, network-security, security. - [pwncat](https://www.automicvault.com/pkg/brew/pwncat/) - Both packages touch the same language runtime or ecosystem. Shared terms: cli, ids, ips, python, python-3-14. ## Combined YAML source View the package source record on GitHub. [combined/suricata.yml](https://github.com/automic-vault/db/blob/main/combined/suricata.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph