Zeek and Suricata Are Now Free Labs

Two weeks ago Wazuh became a free lab.

Now Zeek and Suricata are free too.

You told us detection is where you get stuck, and that there were too few integrations to practise on. So we opened the next two.

What Is Inside

• Zeek and Suricata, deployed and running
• Live Modbus, DNP3, IEC 104 and S7comm traffic from a working process
• Rules you can edit, reload and validate yourself
• Logs produced by an industrial environment, not a capture file

The traffic is the part that matters.

Public captures are small, old and cleaned up. They are fine for learning a log format and useless for learning detection, because nothing in them is happening because you did it.

Here you send the command yourself, then go looking for it.

What You Do

• Open conn.log and map which device talks to which
• Read modbus.log and dnp3.log produced from live traffic
• Write a Suricata rule and reload it
• Send a command inside the lab, then find it in both tools
• Compare what Suricata alerted on with what Zeek recorded

The fourth step is the one people skip.

A rule that exists is not a rule that fires. Between those two states sits the whole discipline: the traffic has to look the way you assumed, on the port you assumed, in the direction you assumed.

You find out by sending the thing and looking.

Why Both, Not One

Suricata asks whether this is known bad. Zeek asks what happened here.

Run them on the same traffic and the difference stops being theoretical. A command that raises no Suricata alert still leaves a Zeek record — and reading that record is how you learn what your rules are missing.

The longer comparison is at labshocksecurity.com/news/zeek-vs-suricata-ot-network-detection

Where This Fits

Wazuh gave you log-based detection over industrial services.

These two add network-based detection over industrial traffic. Same environment, seen from the wire instead of from the host.

Phase 4 is scale, and free labs are how it starts. Every Labshock zone will include detection and validation.

OT security must be testable.

Not documented.

Try It Yourself

• Start free: github.com/zakharb/labshock — runs locally with Docker, no cloud.
• Open the Zeek and Suricata labs at labshocksecurity.com — no license, no trial, no card.
• Write one Suricata rule, send the matching command inside the lab, then confirm it fired and check what Zeek logged alongside it.
• Tell us which tool should become free next: discord.gg/bpmaQFfW76