This overcomes the blindness that Snort has to have signatures split over quite a few TCP packets. Suricata waits right up until all the details in packets is assembled right before it moves the data into analysis. It supports a wide range of log sources and will instantly correlate details https://stephenmoono.tblogz.com/how-ids-can-save-you-time-stress-and-money-47005845