https://cybertoolchain.io/tools/suricata New releases and features in Suricata, tracked by The Cyber Toolchain. en Tue, 15 Sep 2026 13:22:14 GMT https://github.com/OISF/suricata/releases/tag/suricata-8.0.7 https://github.com/OISF/suricata/releases/tag/suricata-8.0.7 Tue, 15 Sep 2026 13:22:14 GMT Suricata 8.0.7 adds dataset subdomain matching, a new `tcp.session` keyword, ARP accept policy option, and SMTP firewall progress states.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `accept-arp` option under `firewall.policies` config to control whether ARP traffic is accepted by the firewall policy engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `default-policy` setting to firewall policy config for specifying a fallback action when no explicit policy matches. • Adds `match subdomain` option to the `dataset` keyword, enabling rules to match subdomains of entries in a dataset. • Adds `tcp.session` keyword for unified TCP lifecycle matching across a session. • Extends `app-layer-protocol` keyword to accept a pipe-separated list of protocol values in a single rule. • Adds firewall progress states to the SMTP parser, enabling policy enforcement at SMTP transaction stages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/suricata https://github.com/OISF/suricata/blob/HEAD/ChangeLog https://github.com/OISF/suricata/blob/HEAD/ChangeLog Tue, 08 Jul 2025 15:56:30 GMT Suricata 8.0.0 adds integer unit support and removes unused stats counters • Adds `kib` unit support for `detect/integers` rule matching to allow size-based detection in kibibytes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/suricata https://github.com/OISF/suricata/blob/HEAD/ChangeLog https://github.com/OISF/suricata/blob/HEAD/ChangeLog Thu, 12 Jun 2025 00:00:00 GMT Suricata 8.0.0-rc1 adds pre_flow/pre_stream hooks, new keywords (tcp.wscale, email.*, ftp.*), pgsql CopyIn, and list-app-layer-hooks CLI flag • Adds `pre_flow` rule hook to run detection logic before flow tracking • Adds `pre_stream` rule hook to intercept traffic before stream inspection • Adds `tcp.wscale` keyword to match TCP Window Scale option values • Adds `email.received`, `email.url`, and `email.message_id` keywords for MIME/Email protocol detection • Adds `ftp.completion_code`, `ftp.reply_received`, `ftp.mode`, and `ftp.dynamic_port` keywords for FTP protocol detection • Adds `query` detection keyword for PostgreSQL (pgsql) protocol inspection • Enables `CopyIn` subprotocol/mode for PostgreSQL database logging • Enhances CPU affinity logic with per-interface NUMA preferences via `cpu-affinity` config Full history on Cyber Toolchain: https://cybertoolchain.io/tools/suricata https://github.com/OISF/suricata/blob/HEAD/ChangeLog https://github.com/OISF/suricata/blob/HEAD/ChangeLog Tue, 08 Apr 2025 00:00:00 GMT Suricata 8.0.0-beta1 adds new protocol parsers (DoH, POP3), Lua sandboxing, and detection keywords. • Adds `doh` support for DNS over HTTPS decoding • Adds `pop3` protocol detection capability • Adds Lua sandboxing via the `lua` subsystem • Adds `requires` rule keyword to specify minimum Suricata version • Adds explicit action scopes with the `action` keywords in rules • Adds new detection keywords: `mime.email.to`, `mime.email.subject`, `mime.email.from`, and `mime.email.cc` • Adds LDAP request/response keywords: `ldap.request.attribute_type`, `ldap.request.attribute`, `ldap.response.operation`, `ldap.distinguished_name` • Adds SMTP detection keywords: `smtp.mail_from`, `smtp.rcpt_to`, and `smtp.helo` • Adds FTP rule keywords: `ftp.reply`, `ftp.command_data`, and `ftp.command` • Enables DPDK RSS configuration using `rte_flow` rules via the `dpdk` config • Provides an `auto` option for DPDK `rx-desc` and `tx-desc` properties in config • Adds TLS ALPN detection with the `tls.alpn` keyword • Adds DNS opcode range matching support using ranges in `dns.opcode` values • Enables integer bitmask detection via the `int:mask:` transform/keyword syntax • Allows binding plugins to specific Suricata versions via plugin metadata Full history on Cyber Toolchain: https://cybertoolchain.io/tools/suricata https://github.com/OISF/suricata/blob/HEAD/ChangeLog https://github.com/OISF/suricata/blob/HEAD/ChangeLog Wed, 14 Jun 2023 00:00:00 GMT Suricata 7.0-rc2 adds DPDK bonding, EVE TCP logging, PF_RING inner clustering, and explicit detect rule types. • `dpdk: add support for bonding interface` • `eve: add stream tcp logging` to EVE JSON output • `yaml: set suricata version in generated config` via `suricata-update dump-sample-configs` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/suricata