The integration brings selected Suricata alert and anomaly events into Sycope, where they can be searched, visualized and correlated with network data already available in the platform.
This allows a Suricata detection to become part of a wider investigation rather than remaining an isolated event. Analysts can examine the alert together with historical network activity and use Sycope to understand the communication surrounding the detected event.
Table of Contents
From a Suricata event to a network investigation
Suricata writes structured event data to its eve.json output. The Sycope integration processes the configured event types, with alert and anomaly enabled by default. It can also import dns, http, tls and fileinfo events when these types are enabled in the integration configuration. These additional event types are required to populate the Protocols and File Analysis dashboards. A deployment using only the default alert and anomaly configuration will not provide the protocol and file data required by these views.
The integration script transforms the selected events into the structure required by a dedicated custom index in Sycope and sends them through the Sycope REST API. A timestamp is maintained between executions to ensure that previously processed events are not imported again.
Once the data is available in Sycope, Suricata events can be searched, filtered and visualized together with other network information. The integration repository also provides a ready-to-import dashboard showing alert trends over time, top signatures and the most frequently involved source and destination IP addresses.
This creates a direct investigation path from a security detection to the traffic and communication associated with the affected systems.
Instead of working only with the information contained in an individual Suricata event, the analyst can use Sycope’s historical network data to examine what happened around the detection and assess it in a broader operational context.
Complementary capabilities, clearly divided
Suricata and Sycope remain independent products. The integration does not replace Suricata or change its detection role. It transfers selected security events into Sycope so that they can be analyzed together with network traffic data.
Suricata provides:
- Security event generation
- Alert and anomaly detection
- EVE JSON event output
- Signature-based information associated with detected activity
- Source and destination information for detected events
Sycope provides:
- Flow-based network analysis
- Historical network communication data
- Host-to-host communication visibility
- Network performance context
- Search and filtering across network data
- Dashboards and visualization
- Correlation of Suricata events with network activity
Suricata identifies activity that matches its detection logic. Sycope adds the surrounding network context and history that can help analysts understand how the event relates to other communication in the environment.
Why threat detection and network history work better together
A security event provides an important indication that particular activity requires attention. During an investigation, however, analysts often need to understand what happened before and around that event, which systems were communicating and whether the activity was isolated or part of a broader pattern.
Historical flow data provides this additional perspective.
Context around a detected event
A Suricata alert identifies a specific security event. Once the event is available in Sycope, it can be examined together with historical traffic associated with the source and destination systems.
This allows analysts to extend the investigation beyond the individual detection and review the communication occurring around the same time.
Information about traffic volumes, communication partners, protocols and the timing of connections can provide additional context when assessing the relevance and potential impact of the event.
The objective is not to replace the information generated by Suricata, but to place that information within the network activity from which it originated.
Historical network evidence during investigation
The integration makes Suricata detections available in a platform that also retains network flow history.
This is useful when an investigation requires information from before the moment when the alert was generated. Analysts can use historical network data to review preceding communication and determine whether the detection represents an isolated event or is associated with earlier activity involving the same systems.
The same approach can be used to examine communication after the event and understand whether activity involving the affected hosts continued.
This provides a broader timeline for investigation without requiring all historical network data to originate from Suricata itself.
Correlation with other network behavior
Suricata events imported into Sycope become another source of information available during network analysis.
An analyst investigating an alert can compare it with communication patterns and other network observations involving the same hosts. This helps relate a signature or anomaly detected at one point in time to the behavior visible across a longer period.
The resulting investigation combines two different types of evidence: the security event generated by Suricata and the network history maintained by Sycope.
Faster access to relevant context
Without an integration, analysts may need to identify an alert in one system and then manually reconstruct the related network activity in another tool.
Importing Suricata events into Sycope provides a common point from which the analyst can search the event and continue into network analysis.
Predefined dashboards and filtering capabilities also make it possible to review recurring signatures, affected hosts and changes in alert activity over time.
Suricata events as part of the Sycope analytical workflow
Once imported into the dedicated custom index, Suricata data can be processed using the analytical capabilities available in Sycope.
The ready-made dashboard provided with the integration includes views for alert trends, top Suricata signatures and the source and destination IP addresses most frequently associated with events.
Teams can also build or modify dashboards according to their own operational requirements. The current Sycope article describes the dashboards as customizable, allowing Suricata data to be presented according to the needs of a specific security workflow.
This makes the integration useful both for individual incident investigation and for identifying recurring patterns across a larger set of Suricata events.
For example, an increasing number of events associated with a particular signature can be viewed over time, while top source and destination information can help identify systems repeatedly involved in detections.
The analyst can then continue the investigation using network data available in Sycope rather than treating the dashboard only as a reporting view.
A ready, documented integration
The repository includes the Python-based event processor, configuration files, installation and removal scripts, examples and four ready-to-import Sycope dashboards: Overview, Alert Analysis, Protocols and File Analysis.
By default, the integration processes alert and anomaly events. It can also import dns, http, tls and fileinfo events when these types are enabled in the integration configuration. The additional event types are required to populate the Protocols and File Analysis dashboards, so a deployment using only the default configuration will not provide data for these views.
The integration also supports whitelists and blacklists for controlling which Suricata alerts and anomalies are imported. Specific signatures or anomaly types can therefore be included or excluded according to the requirements of the environment.
The current requirements are:
- Python 3.8 or later
- Suricata 6.0 or later
- Sycope 3.1 or later with API access
- Python requests module
Suricata remains installed and configured independently. The integration does not deploy or configure Suricata itself; the provided components are responsible for processing its EVE JSON output and transferring selected events to Sycope through the REST API.
How the integration works
The integration consists of four main building blocks.
Suricata EVE JSON events
Suricata generates security information in its eve.json output.
The integration uses this file as its event source. By default, it processes alert and anomaly event types, although the configuration defines which types should be included.
Suricata continues to operate independently as the detection engine and does not need to be installed on the Sycope appliance.
Event processing and filtering
The eve_processor.py script reads new events from the Suricata log and applies the filtering rules defined in the integration configuration.
Whitelists and blacklists can be used to control which anomalies and signatures are transferred.
Each selected event is then transformed to match the field structure of the custom index prepared in Sycope.
The processor maintains the timestamp of the last handled event, allowing subsequent executions to continue from the correct point without repeatedly importing the same records.
REST API ingestion into Sycope
Processed Suricata events are sent to Sycope through the REST API and stored in a dedicated custom index.
A dedicated Sycope user and role can be created for the integration with permissions limited to injecting data into custom indexes.
The integration script can operate on the same host as Suricata or another suitable system, but running it directly on the Sycope appliance is not supported because of the platform’s permission and isolation model.
Search, dashboards and correlation
Once imported, Suricata events are available in Sycope for search, filtering, visualization and correlation with network information.
The provided dashboard can be imported directly into Sycope and connected to the Suricata index. It includes alert trends, top signatures and top source and destination IP addresses.
Organizations can use the supplied dashboard as a starting point or adapt the presentation and analysis to their own security processes.
Investigation with detection and network context in one workflow
Consider a Suricata alert associated with suspicious communication between an internal host and another system.
Suricata generates the event and records it in eve.json. The integration processor selects the event, maps its fields and transfers it through the REST API to the dedicated Suricata index in Sycope.
The analyst can identify the event in Sycope and review the source, destination and signature information received from Suricata.
The investigation can then continue using the network data available for the same systems and time period. Historical communication can provide additional information about activity preceding the alert, other connections involving the affected host and whether the observed event appears to be isolated or part of a wider sequence.
Suricata remains responsible for the detection itself, while Sycope provides the network history and analytical environment used to extend the investigation.
This division preserves the role of the existing IDS/IPS while giving its events additional operational context.
Keeping Suricata detection independent
The integration is intentionally focused on bringing Suricata information into Sycope for analysis.
It does not install Suricata, modify its configuration or send changes back to the detection engine. Suricata continues to operate as an independent source of security events, while Sycope consumes selected alerts and anomalies through the integration layer.
This allows organizations that already use Suricata to retain their existing detection setup and add flow-based network context without redesigning the IDS/IPS deployment itself.
The result is a workflow in which Suricata detections can be investigated with additional network history, communication context and visualization in Sycope.
See the integration in your environment
The Sycope–Suricata integration connects security detections with the network activity surrounding them.
Suricata continues to provide alert and anomaly information, while Sycope makes those events available alongside historical traffic and network context for further analysis.
This provides analysts with a broader view of detected activity while allowing both technologies to retain their existing roles.
Want to see how Suricata events can be enriched with network context in Sycope? Schedule a call with our team.
