Share your Suricata Tips with all!

Hello, everyone!

Do you know any interesting tips and tricks related to Suricata that make your life easier? Would you like to share them with the world?
In case you did not know, we post weekly Suricata Tips on our Twitter account. Example of the most recent one:

We understand that a lot of you work closely with Suricata and would have many tips about usage, development and/or configuration. If you can, please post your tip on this thread (and if not, make sure to add them under “Tips and tricks” category) so that others can find it easily.

We would also like your permission to post your tip from our Twitter account as a part of our weekly tip sharing regime. Please share your twitter handle in case you’d like to receive a shout-out from the official Suricata_IDS Twitter account.

Thank you very much!

Format for the tip:

suricata.yaml (as an attachment)


Elaborate description for us to verify the tip

Twitter handle (in case you’d like a shout-out)



If it is a command line or jq output, it does not conform to the tips format.



That’s not an issue, as long as it’s a valid tip, we can work on making it format compliant, or we can also adjust the format :wink: