Experimental Suricata Training Environment

This project provides a complete, containerized training environment for learning Suricata, a popular open-source network intrusion detection and prevention system (IDS/IPS). It allows users to safely experiment with Suricata's detection capabilities by replaying real-world network traffic captures (PCAPs) in an isolated lab setup.

Key Features

• Docker-Based Environment — A pre-configured, isolated lab using Docker Compose for easy setup and consistency across operating systems.
• Hands-On PCAP Replay — Includes scripts and sample PCAP files to replay malicious network traffic, enabling practical detection rule testing.
• Integrated Event Visualization — Comes with EveBox, a web-based interface accessible via localhost for visually inspecting Suricata's security events (EVE JSON output).
• Interactive CLI Access — Provides direct bash shell access to the Suricata container for running commands and analyzing results.

Philosophy

The project emphasizes a practical, learn-by-doing approach to cybersecurity training, lowering the barrier to entry for understanding network threat detection by providing a ready-to-use, reproducible lab environment.