SELKS
SELKS is a free, open-source Suricata-based implementation for network intrusion detection and prevention, security monitoring, and threat hunting.
What SELKS is
SELKS is a free, open-source Suricata-based implementation for network intrusion detection and prevention, security monitoring, and threat hunting. Its web interface can manage multiple Suricata rulesets and threat intelligence sources, as well as custom rules and IoC data files. Predefined hunting filters and contextual views support investigation, while thresholding and suppression can help reduce noisy alerts. SELKS 10 includes Suricata, Elasticsearch, Logstash, Kibana, Stamus Community Edition, and functionality from Arkime, Evebox, and CyberChef. It can capture packets connected to detection events and export session PCAP files for investigation or playback in SELKS or other tools. Deployment options include Docker Compose for Linux and Debian-based ISO images, with or without a desktop, for bare metal or virtual machines. The project is free under GPL 3.0-or-later. It is a legacy product: Stamus Networks stopped actively enhancing it on January 1, 2025, and has no future releases planned. Stamus says it was not designed for enterprise deployment.
Good
- Free and open source under GPL 3.0-or-later
- Web interface manages rulesets and threat intelligence
- Can export event-related session PCAP files
- Docker Compose and Debian-based ISO deployment options
Watch out
- No future releases are planned
- Not designed for enterprise deployment
- Active enhancement stopped January 1, 2025
Who it suits
SELKS suits practitioners, researchers, educators, students, and hobbyists exploring Suricata, as well as many small-to-medium organizations. It is not intended for enterprise deployment.
Verdict
SELKS brings Suricata monitoring, hunting, and packet investigation together with multiple deployment options. Its legacy status and lack of planned releases are important constraints for anyone considering it.
Plans and prices
From SELKS's own pricing page, checked 15 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| SELKS | Free | free and open source · GPL 3.0-or-later · Debian ISO or Docker Compose on Linux |
The facts
Each one read from SELKS's own pages, with the date it was checked.
What it does
- Arkime upgrade
- SELKS 10 added Arkime 5 capabilities including bulk search, improved session details, unified authentication, JA4 support and offline PCAP retrieval improvements.checked 15 Oct 2026
- Conditional packet capture
- SELKS 10 can capture packets associated with detection alerts and export the resulting PCAP evidence.checked 15 Oct 2026
- Core components
- The stack includes Suricata, Elasticsearch, Logstash, Kibana and Stamus Community Edition, with Arkime, EveBox and CyberChef added later.checked 15 Oct 2026
- Credential complaint
- That walkthrough reported that the documented root password did not work for its installation.checked 15 Oct 2026
- Dashboards
- The repository describes more than 28 default dashboards, over 400 visualizations and 24 predefined searches.checked 15 Oct 2026
- Database
- SELKS 10 replaced SQLite with PostgreSQL to address known issues and improve scalability.checked 15 Oct 2026
- Datasheet requirements
- The SELKS datasheet specifies at least 2 cores, 8–10 GB RAM and 100 GB free disk, recommending high-performance SSD storage.checked 15 Oct 2026
- Deployment
- The archive page offers a Docker Compose package for Linux and Debian-based ISO images with or without a desktop, deployable on bare metal or a virtual machine.checked 2 Oct 2026
- Deployment methods
- SELKS can run from a Docker Compose package or as Debian-based ISO images on bare metal or virtual machines.checked 15 Oct 2026
- Detection and monitoring
- SELKS uses Suricata-generated data for IDS/IPS, network security monitoring, and threat hunting.checked 2 Oct 2026
- Documentation depth
- The project wiki includes user setup, Docker and ISO installation, developer build/customization material, tutorials, Splunk documentation and older-version guides.checked 15 Oct 2026
- Enterprise limit
- The README says SELKS is suitable for small and medium organizations but was not designed for enterprise-scale deployment.checked 15 Oct 2026
- External Elasticsearch limit
- A Suricata forum user reported that connecting SELKS to an external Elasticsearch server left Hunting dashboards and events showing no data.checked 15 Oct 2026
- Historical reliability complaint
- A SELKS mailing-list thread records Kibana dashboard failures and Elasticsearch mapping errors after shard and configuration changes.checked 15 Oct 2026
- Included components
- SELKS 10 includes Suricata, Elasticsearch, Logstash, Kibana, Stamus Community Edition, and functionality from Arkime, Evebox, and CyberChef.checked 2 Oct 2026
- Independent use case
- A university thesis deployed SELKS in VMware, used Suricata for real-time traffic analysis and tested customized rules against crafted IIoT packets.checked 15 Oct 2026
- Installation duration
- A Spanish independent walkthrough reported that the Docker deployment took roughly 10 to 15 minutes after the base installation.checked 15 Oct 2026
- Integrations
- The documented deployment can send logs to a Splunk indexer and optionally authenticate users through LDAP or LDAPS.checked 15 Oct 2026
- Intended users
- Stamus Networks describes SELKS as suitable for many small-to-medium organizations and says practitioners, researchers, educators, students, and hobbyists use it to explore Suricata.checked 2 Oct 2026
- Learning curve
- The same reviewer said moving from Snort to Suricata involved a noticeable learning curve, although the rule and configuration concepts became familiar.checked 15 Oct 2026
The company
- Company founded
- Stamus Networks was founded in 2014.checked 15 Oct 2026
- Company headquarters
- Stamus Networks lists Indianapolis, Indiana as its headquarters.checked 15 Oct 2026
- Company size
- LinkedIn lists Stamus Networks in the 11–50 employee size range.checked 15 Oct 2026
- Founded
- 2014checked 28 Sep 2026
Alternatives to SELKS
- 1
OPNsense
Free planOpen sourceAndroidiOSWebAPI8.6Free plan - 2
CrowdSec
Free planOpen sourceiOSWebAPIExtension8.5From $49 a month - 3
Wazuh
Free planOpen sourceWebAPILinuxmacOS8.4From $571 a month - 4
IPFire
Free planOpen sourceWebAPILinuxSelf-hosted8.0From $1,099 a year - 5
OSSEC
Free planOpen sourceAPILinuxmacOSSelf-hosted8.0From $55 a year - 6
Arista NG Firewall
Free planWeb7.5Free plan