# \[blog\] The Hidden Value of Suricata Detection Events: NSM-Enriched IDS Alerts

**URL:** <https://forum.suricata.io/t/blog-the-hidden-value-of-suricata-detection-events-nsm-enriched-ids-alerts/3382>\
**Category:** Community Announcements\
**Tags:** suricata\
**Created:** [March 31, 2023, 4:37pm UTC](https://forum.suricata.io/t/blog-the-hidden-value-of-suricata-detection-events-nsm-enriched-ids-alerts/3382 "2023-03-31T16:37:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmarkdurrett](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/dmarkdurrett/32/816_2.png) [@dmarkdurrett](https://forum.suricata.io/u/dmarkdurrett)\
**Post date:** [March 31, 2023, 4:37pm UTC](https://forum.suricata.io/t/blog-the-hidden-value-of-suricata-detection-events-nsm-enriched-ids-alerts/3382/1 "2023-03-31T16:37:02Z")

</div>

Most casual Suricata users don’t understand …

There is a wealth of valuable information contained in a Suricata detection event record (aka “alert”). Beginning in 2014, the world’s most popular open-source security engine - Suricata - has included the complete application-layer metadata in every IDS alert record.

So, it’s all there - right in the alert record.

Despite what some vendor marketing implies, if you’ve got Suricata, there is NO NEED to:

- perform any external correlation
- deploy a separate NSM
- waste CPU cycles by combining two detection engines in the same sensor

Read more in this article by Eric LEBLOND:

> **[The Hidden Value of Suricata Detection Events: NSM-Enriched IDS Alerts](https://www.stamus-networks.com/blog/the-hidden-value-of-suricata-detection-events-nsm-enriched-ids-alerts)**
>
> There is a wealth of valuable information contained in a Suricata detection event record (aka "alert"). Beginning in 2014, the world's most popular open-source security engine - Suricata - has included the complete application-layer metadata in every...