Hello guys, I want to build small IDS lab for pcap analysis only and I want to use Zeek with Suricata or/and Snort++. I didn’t find good comparison between snort3 and suricata, so I’m asking here. Which one would you recommend to use with Zeek, maybe both? CPU/RAM don’t care. If I combine snort3 and suricata, do I get more intrusion detection rates (as well more false positives obviously)?
Thank you
Jerm
If it’s a lab it would be best to test both combinations, in general Suricata and Snort detection should be close but a lot has changed so 100% comparison is not possible anymore. It also highly depends on the ruleset.