Indicators of Compromise

import { Aside, Steps } from ‘@astrojs/starlight/components’;

Suricatavel manages an active threat database of Indicators of Compromise (IOCs) to detect and contain known malicious infrastructure across your network.

Supported IOC types

Suricatavel supports the following artifact types:

IPv4 / IPv6 addresses
Domain names and FQDNs
URLs
Cryptographic file hashes (MD5, SHA-1, SHA-256)

How IOCs are populated

The IOC database is continuously maintained through multiple ingestion channels:

Automatic extraction: As network alerts are ingested, Suricatavel automatically parses observable indicators from alert payloads and records them in the database.
Threat intelligence feeds: The rule synchronization engine (suricatavel rules fetch) pulls external threat feeds (e.g. Abuse.ch, Emerging Threats, Drongo) and imports new indicators automatically.
Manual creation: Analysts can create custom IOCs directly from the web interface or promote indicators discovered during event triage.

Tagging and categorization

Organize and triage threat intelligence indicators using tags and categories:

Campaign tagging: Group indicators under threat actor names or malware family labels.
Confidence levels: Filter IOCs by reputation scores generated by threat enrichment providers.
Policy automation: Policies can trigger automated firewall bans or ticketing alerts based on specific tags or IOC score thresholds.

Detection and Suricata Datasets

Suricatavel provides two complementary detection layers:

1. In-flight engine detection (Suricata Datasets)

Rather than generating millions of text-based rules that slow down pattern matching, Suricatavel compiles active IOCs into native Suricata 7+ Datasets:

High-throughput memory sets: IPs, domains, and hashes are formatted into indexed dataset files deployed directly to sensor nodes.
Hardware-efficient evaluation: Suricata performs fast in-memory lookups during packet processing with near-zero latency impact.
Deployment tracking: Inspect active dataset rule generation and per-sensor deployment status under Sensors > Rules deployment.

2. Post-ingestion correlation

When alert batches arrive from sensors:

An IOC observation is created linking the alert to the known indicator.
The indicator’s last_seen timestamp and total observation counters are incremented.
Analysts can jump from any IOC to all related observations and incidents.