Suricata, Supercharged.

A powerful bolt-on toolkit that transforms Suricata into a capable NDR with AI-powered detection and automated response.


Suricata-Native	Reads EVE JSON directly from Unix socket.
Columnar Storage	Apache Parquet with Zstd compression for fast analytical queries.
Behavioral Detection	Graph-based threat hunting: beaconing, lateral movement, exfiltration.
Automated Response	Publish alerts to MQTT, Kafka, or webhooks for n8n, Fluent Bit, Vector, or SIEM integration.
Interactive Reports	Self-contained HTML dashboards with Chart.js and D3.js.
Air-Gap Ready	Fully offline operation. No cloud dependencies required.
Single Binary	Rust. No runtime dependencies. Deploy from .deb package or Docker container.

Architecture

Suricata EVE JSON ──► rockfish detect ──► Parquet ──► S3 (optional)
                                              │
                          ┌───────────────────┴───────────────────┐
                          ▼                                       ▼
                       Report                                   Hunt
                    (HTML pages)                          (threat detection)
                                                                │
                                                                ▼
                                       Alert
                              (MQTT / Kafka / Webhook)

An event is a single JSON record from Suricata’s EVE log — one line, one record. Every alert, flow, DNS transaction, HTTP request, TLS handshake, or protocol log entry is one event. Event rate limits in license tiers are measured by counting these individual JSON records per minute.

Core Pipeline

Input — Rockfish connects directly to Suricata’s EVE output via Unix socket for real-time streaming or file tailing for batch processing. No agents. No sidecars. No middleware.

Parse — Events are strongly typed, parsed into native Rust structures, and routed by event type. Optional enrichment layers add GeoIP geolocation and IP reputation scoring before writing to columnar storage. Configurable include/exclude event filtering, memory-bounded buffering, and multi-sensor partitioning for distributed deployments.

Store — All events are written to Apache Parquet with Zstd compression and hive-style date partitioning. Embedded DuckDB provides sub-second analytical SQL at query time. Optional AWS S3 / MinIO / DigitalOcean Spaces upload for long-term retention.

Analyze — Two complementary engines operate on the same Parquet data. Hunt builds communication graphs and applies 12 behavioral detection algorithms (beaconing, lateral movement, C2 fanout, port scanning, DNS tunneling, data exfiltration, and more) with ML-based anomaly detection for unknown threats. Report renders self-contained HTML dashboards with Chart.js and D3.

Respond — Detection findings and enriched alerts are published to MQTT, Kafka, and webhooks for downstream automation. Integrate with Fluent Bit, Vector, n8n, Node-RED, or any consumer for SIEM forwarding and SOAR workflows.

Commands at a Glance

Command	Description
`rockfish detect`	Ingest EVE JSON, run OCCAM detection and behavioral threat hunting
`rockfish report`	Generate static HTML NDR report
`rockfish alert`	Publish detection events to MQTT, Kafka, or webhooks
`rockfish http`	Serve report pages over HTTP with authentication
`rockfish auto`	Run hunt + report automatically at set intervals
`rockfish prune`	Remove old Parquet files by retention policy
`rockfish compact`	Compact and merge Parquet files for storage efficiency
`rockfish rule`	Manage Suricata rules + sources (`rule update`, `list`, `enable`, …)
`rockfish config`	Show resolved configuration and features
`rockfish stats`	Parse EVE JSON and show event type statistics

Technical Foundation

Language: Rust — single static binary, no runtime dependencies
Query Engine: Embedded DuckDB for analytical SQL on Parquet
Storage Format: Apache Parquet with Zstd compression
Protocols: MQTT, Kafka, Webhooks
Crypto: Ed25519 license verification, TLS 1.3 transport
Concurrency: Rayon parallel query execution, Tokio async I/O

Companion Repositories

Rockfish Toolkit — the open deployment kit for Rockfish NDR: Suricata plugins that complement it — 16+ OT/IIoT application-layer parsers (Modbus, DNP3, S7comm, OPC UA, MQTT, BACnet, IEC 61850, IEC 60870-5-104, EtherNet/IP, EtherCAT, PROFINET, RTPS/DDS, ASTERIX, and more), the payload_entropy plugin for encrypted-traffic analysis, the transport_perf plugin for per-flow TCP/UDP performance, and the FMADIO ring-buffer capture plugin. All emit structured events through Suricata’s eve-log into the Rockfish NDR pipeline.

Next Steps

Quick Start - Get up and running in minutes
Configuration - YAML configuration reference

Rockfish NDR Documentation