How to use the Suricata network monitoring agent skill

What this skill makes the agent do

Agent skills are folders of instructions and optional helper scripts that an AI agent loads when your request matches the skill's description. This skill covers deploying and configuring Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging and custom rules for protocol-aware inspection of HTTP, TLS, DNS and SMB traffic, plus SIEM integration.

• Install Suricata and its helper tools (suricata-update and jq) on Ubuntu or Debian, or from source
• Set network interface options and AF_PACKET settings in suricata.yaml
• Download community rulesets with suricata-update and disable noisy rules
• Write custom local rules and add them to the configuration
• Send structured JSON logs (EVE JSON) for ingestion into Elasticsearch or Splunk
• Run a helper script that checks whether Suricata is installed and running, validates the config and analyses logs

How to install the skill

Download the ZIP file from this page and unzip it. You can install the skill in one of two ways.

For personal use across projects, unzip the folder into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

What the skill needs before you start

The skill assumes the software and hardware below are in place. The agent can guide you through the steps, but it cannot supply a network tap or a span port for you.

• Suricata 7.0 or later, plus suricata-update and jq
• A network interface on a span port, tap, or inline bridge
• An Emerging Threats Open ruleset (free), or Pro or Snort Talos rules with an oinkcode
• Elasticsearch/Kibana or Splunk, optional, for log analysis

How to trigger the skill with natural requests

You do not need a special command. Describe the task in plain language that mentions Suricata or the job you want done. The skill loads when the request matches its description, which covers deploying or configuring Suricata in IDS or inline IPS mode, and combining signature detection with protocol anomaly detection and file extraction.

Good requests name the goal and the environment, for example: help me set up Suricata in IDS mode on eth1 with the Emerging Threats Open rules. The more specific you are about your network and what you want to detect, the more useful the answer.

• Help me install Suricata 7 on Ubuntu and validate the config.
• Walk me through enabling the et/open rule source and disabling noisy SIDs.
• Summarise the alerts in my eve.json file by signature and source IP.
• Write a local rule that flags SSH brute force from outside my network.

Examples of what you can ask for

The skill's workflow follows five steps: install, configure interfaces, configure suricata.yaml, manage rulesets, then deploy and validate. Ask the agent to work through one step at a time so you can check each result.

• Set HOME_NET and EXTERNAL_NET for our private ranges 10.0.0.0/8 and 192.168.0.0/16.
• Explain what the EVE JSON event types alert, http, dns and tls contain.
• Check whether the Suricata process is running and whether the config validates.
• Review the local.rules file for rules that would match too much normal traffic.

Safety notes before you deploy

The skill includes scripts/agent.py, which checks installation and process state, validates configuration and analyses logs. The skill's manifest marks it as running scripts and using the network, so review the script before running it, and run it only on systems you own or administer.

Inline IPS mode can block legitimate traffic or disrupt production networks if rules are wrong. Test in IDS mode first. The skill also does not provide TLS decryption, so it will not see inside most HTTPS payloads. Traffic capture and rule changes need proper authorisation.

• Review scripts/agent.py before running it.
• Start in IDS mode before enabling inline IPS.
• Only capture traffic and change rules on networks you are authorised to manage.

Tips for better results

Give the agent your interface name, your private address ranges and your SIEM choice at the start, since the configuration depends on them. Ask it to show the exact changes before you apply them. For reference details, the skill includes an API reference covering the Suricata CLI, suricata-update commands and EVE JSON event types. A Spanish version of the instructions (SKILL.es.md) is also included.

• Provide your interface, address ranges and SIEM up front.
• Ask for each change to be shown before it is applied.
• Use the included reference for CLI flags and EVE event types.