What problem does it solve?
A Suricata sensor that loaded zero signatures reports zero alerts, which looks identical to a clean capture. This Skill prevents false 'all clear' conclusions by exposing the detector's posture (ARMED, INERT, or UNKNOWN) alongside every alert list, so analysts know whether the detector actually inspected the traffic.
Core Features & Use Cases
- Posture-aware alert triage: Every
nsm_alerts response carries suricata_posture and signature counts, so an empty alert list is never mistaken for a clean verdict when the ruleset was never loaded.
- Severity-filtered alert review: Query alerts with
min_severity=2 for human-priority findings, then pull the unfiltered list while respecting truncated pagination flags.
- Session corroboration: Pivot from any alert to full Zeek session context via
nsm-session-pivot, turning a signature match into an investigable incident.
- Use Case: Given a
.pcap from a CML or GNS3 lab capture, run nsm_status to check ruleset age, update rules if needed, then triage alerts and pivot to sessions to determine whether known-bad traffic is present.
Quick Start
Ask the agent to triage Suricata IDS alerts in a specific pcap file and report the detector posture, signature count, and severity-filtered findings.
