Suricata

An intrusion-detection pilot should measure signal quality and operational cost. Suricata can inspect network traffic and emit structured EVE events; the difficult part is getting relevant coverage without overwhelming responders.

Replay a sanitized sample of your own traffic and a known benign test pattern. Confirm packet capture position, dropped-packet rate, TLS visibility limits, rule-set version, and whether the expected event appears in EVE JSON. Review several false positives with the people who will triage them. If considering inline prevention, test failure behavior and latency separately from passive monitoring.

Define who updates signatures, validates custom rules, monitors the sensor, and investigates alerts. Compare alternative tools using the same traffic and the same detection criteria. Never describe “no alerts” as proof of safety when the sensor might not have seen the traffic.