# Implementing Suricata in production environment

**URL:** https://forum.suricata.io/t/implementing-suricata-in-production-environment/2492
**Category:** Help
**Tags:** community, suricata
**Created:** [May 12, 2022, 9:37am UTC](https://forum.suricata.io/t/implementing-suricata-in-production-environment/2492 "2022-05-12T09:37:04Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![anas33](https://avatars.discourse-cdn.com/v4/letter/a/b2d939/32.png) [@anas33](https://forum.suricata.io/u/anas33)
#### Post date: [May 12, 2022, 9:37am UTC](https://forum.suricata.io/t/implementing-suricata-in-production-environment/2492/1 "2022-05-12T09:37:04Z")

</div>

Hello All,

My organization wants to implement Suricata as an IDS, but I don’t know how.

It would be very helpful if you can tell me all the requirements I need (How many instances, Hardware requirements, sensor management system solutions … )

Thanks in advance.

---

<div class="post-metadata">

### Author: ![IDSTower](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/idstower/32/861_2.png) [@IDSTower](https://forum.suricata.io/u/IDSTower)
#### Post date: [May 14, 2022, 6:21am UTC](https://forum.suricata.io/t/implementing-suricata-in-production-environment/2492/2 "2022-05-14T06:21:10Z")

</div>

It is highly dependant on you network, physical or virtual, number of branches…etc  
to keep things simple, you will need the following to start with:-

1. a way to mirror the traffic from your network to Suricata servers, you can start with a port mirror on your main switch and later move to other options (eg: physical taps + taps aggregation).
2. a single Suricata server, HW requirements varies depending on traffic in the network, a single-socket intel server with 18 core, 128GB of RAM & SSD drives can be a good start, this server should be able to handle ~10Gbps when tuned.
3. you will need a UI to view and analyze alerts, and ELK stack can be a good starting point, or you can forward the alerts to your SIEM if you have one.

as for sensors management solutions, I will recommend my own 😉 , as [it is totally free for a single Suricata host](https://www.idstower.com/), but then there are other alternatives you can search for.
