Development of Suri Oculus 4.0 is nearly complete, and the official release is planned for early this fall.
The primary goal of this release is not just to introduce new features, but to expand Suricata’s network visibility while keeping the platform lightweight and easy to deploy.
Version 4.0 introduces two major new components:
-
Host Behavior Fingerprint (HBF)
-
Local Rules
Host Behavior Fingerprint (HBF)
Host Behavior Fingerprint (HBF) is a new module designed to analyze the behavior of devices within a local network.
Instead of focusing on individual Suricata events, HBF builds a behavioral profile for every detected host.
For each device, Suri Oculus automatically collects information such as:
- IP address
- MAC address
- Hostname (when available)
- Network interface
- First and last seen timestamps
- Total processed events
- Number of Flow, DNS, HTTP, TLS, and Alert events
- Transport protocol statistics
- Most frequently used destination ports
- Most frequently queried DNS names
- Most frequently observed TLS SNI values
- Remote hosts the device has communicated with
This profile makes it much easier to understand how a device behaves without manually reviewing thousands of individual events.
Within seconds, an analyst can identify whether a device is likely to be:
- a workstation,
- a server,
- a gateway,
- an IoT device,
- a printer,
- or a system exhibiting unusual network activity.
HBF is designed as the foundation for more advanced behavioral analysis planned for future releases.
Local Rules
The second major addition in version 4.0 is the new Local Rules interface.
Administrators can now manage Suricata local rules directly from the Suri Oculus web interface.
The module supports:
- viewing existing rules;
- creating new rules;
- editing rules;
- deleting rules;
- enabling and disabling rules;
- searching and filtering rules.
This significantly simplifies daily rule management and eliminates the need for constant manual editing of rule files.
Project Roadmap
Suri Oculus was created as a lightweight alternative to large-scale security monitoring platforms while maintaining high performance and a simple architecture.
The platform is written primarily in C++ and uses its own REST API to work alongside Suricata without requiring a heavy analytics stack.
Version 4.0 represents the most significant update to the project so far.
Future development will continue toward deeper behavioral analysis, historical data storage, and more advanced detection and investigation capabilities.
As always, feedback and suggestions from the Suricata community are greatly appreciated.