Suricata on Ubuntu 24.04 LTS

Suricata is a high performance, open source network threat detection engine from the Open Information Security Foundation. It reads frames off a network interface, reassembles flows, evaluates them against a signature set, and writes alerts plus rich protocol metadata to eve.json. This cloudimg image runs Suricata 8.0.6 on Ubuntu 24.04 LTS from the vendor's own apt origin, so unattended upgrades keep the engine current rather than frozen at capture.

What it does on Azure, stated plainly. Suricata's core mechanism, inspecting the packets it is given, works exactly as designed on an Azure VNet, proven at build time with a real signature firing on real traffic. What Azure constrains is visibility scope, not the mechanism: a VNet NIC receives only the frames addressed to it, and Virtual Network TAP never reached general availability. This appliance cannot passively monitor a subnet the way a physical tap or SPAN port can. Three topologies are real and all three are documented: host IDS on this VM's own eth0 traffic, working out of the box; inline, where IP forwarding plus a user defined route lets it inspect everything routed through it, the honest way to cover other machines; and offline forensics on pcap files.

No ruleset is baked in, by design. Signatures frozen at capture are stale the moment they ship, and an IDS with stale rules reports healthy while missing everything published since. First boot fetches the current Emerging Threats Open ruleset on your VM and a timer refreshes it daily, so your rules come from the provider and are current on day one.

Suricata is GPL-2.0, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by OISF. The cloudimg charge covers packaging, hardening, security patching and 24/7 support with a 24 hour response SLA.