Use Suricata-IDS as a WAF

Help
1

Hello,
Is it possible to use Suricata-IDS as a WAF? Something like “ModSecurity” or “Shadow Daemon”.

Thank you.

2

No, not really. The biggest obstacle is with encryption, without extra TLS decryptors you just can’t see whats happening over the majority of http traffic these days. If you need a WAF, you should probably use a WAF as they shouldn’t have this issue.

1 Like
3

If Suricata-IDS run in drop mode then?

4

Its more about what it can see. As most traffic is HTTPS these days, Suricata can’t see it other than the TLS details. A real WAF usually works post-decryption so can see all. If you need a WAF, you need a WAF, not Suricata.

1 Like
5

Can Suricata-IDS implement it in the future?

6

No, I don’t think so. WAFs, usually implemented as a proxy are way more aware of the HTTP sessions they are protecting. They are differnet tools for different jobs.

1 Like