Skip to content
SPECIFICTION
Get listed

SELKS

stamus-networks.com

Free plan Open source WebWindowsLinuxSelf-hosted
Visit stamus-networks.com
Spec score 8.3 #7 of 39 in Intrusion Detection and Prevention Software

What it is

SELKS is a free, open-source software package for network intrusion detection and prevention, network security monitoring, and threat hunting, built around Suricata. Its web interface manages Suricata rulesets, threat intelligence sources, custom rules, and IoC data files. Predefined filters and contextual views support threat hunting; thresholding and suppression can help reduce noisy alerts. SELKS 10 includes Suricata, Elasticsearch, Logstash, Kibana, Stamus Community Edition, and functionality from Arkime, Evebox, and CyberChef. It can capture packets tied to detection events and export session PCAP files for investigation or playback in SELKS or other tools. Deployment options include Docker Compose for Linux and Debian-based ISO images, with or without a desktop, on bare metal or a virtual machine. SELKS is licensed under GPL 3.0-or-later. Stamus Networks says it stopped actively enhancing the legacy product on January 1, 2025, and has no future releases planned. The maker says SELKS was not designed for enterprise deployment.

Spec sheet

What it does
SELKS combines Suricata intrusion detection/prevention, network-security monitoring and threat hunting in a turnkey Debian-based distribution.Read 15 Oct 2026 · docs.stamus-networks.com
Intended users
Stamus Networks describes SELKS as suitable for many small-to-medium organizations and says practitioners, researchers, educators, students, and hobbyists use it to explore Suricata.Read 2 Oct 2026 · stamus-networks.com
Deployment
The archive page offers a Docker Compose package for Linux and Debian-based ISO images with or without a desktop, deployable on bare metal or a virtual machine.Read 2 Oct 2026 · stamus-networks.com
Integrations
The documented deployment can send logs to a Splunk indexer and optionally authenticate users through LDAP or LDAPS.Read 15 Oct 2026 · docs.stamus-networks.com
Support
The maker directs users to GitHub for documentation, issues, and the wiki, and to Discord for questions and help.Read 2 Oct 2026 · stamus-networks.com
License
SELKS is free and open source under the GPL 3.0-or-later license.Read 2 Oct 2026 · stamus-networks.com
Founded
2014Read 28 Sep 2026 · stamus-networks.com
Arkime upgrade
SELKS 10 added Arkime 5 capabilities including bulk search, improved session details, unified authentication, JA4 support and offline PCAP retrieval improvements.Read 15 Oct 2026 · stamus-networks.com
Company founded
Stamus Networks was founded in 2014.Read 15 Oct 2026 · linkedin.com
Company headquarters
Stamus Networks lists Indianapolis, Indiana as its headquarters.Read 15 Oct 2026 · linkedin.com
Company size
LinkedIn lists Stamus Networks in the 11–50 employee size range.Read 15 Oct 2026 · linkedin.com
Conditional packet capture
SELKS 10 can capture packets associated with detection alerts and export the resulting PCAP evidence.Read 15 Oct 2026 · stamus-networks.com
Core components
The stack includes Suricata, Elasticsearch, Logstash, Kibana and Stamus Community Edition, with Arkime, EveBox and CyberChef added later.Read 15 Oct 2026 · stamus-networks.com
Credential complaint
That walkthrough reported that the documented root password did not work for its installation.Read 15 Oct 2026 · ciberseguridad.blog
Dashboards
The repository describes more than 28 default dashboards, over 400 visualizations and 24 predefined searches.Read 15 Oct 2026 · github.com
Database
SELKS 10 replaced SQLite with PostgreSQL to address known issues and improve scalability.Read 15 Oct 2026 · stamus-networks.com
Datasheet requirements
The SELKS datasheet specifies at least 2 cores, 8–10 GB RAM and 100 GB free disk, recommending high-performance SSD storage.Read 15 Oct 2026 · stamus-networks.com
Deployment methods
SELKS can run from a Docker Compose package or as Debian-based ISO images on bare metal or virtual machines.Read 15 Oct 2026 · stamus-networks.com
Detection and monitoring
SELKS uses Suricata-generated data for IDS/IPS, network security monitoring, and threat hunting.Read 2 Oct 2026 · stamus-networks.com
Documentation depth
The project wiki includes user setup, Docker and ISO installation, developer build/customization material, tutorials, Splunk documentation and older-version guides.Read 15 Oct 2026 · github.com
Enterprise limit
The README says SELKS is suitable for small and medium organizations but was not designed for enterprise-scale deployment.Read 15 Oct 2026 · github.com
External Elasticsearch limit
A Suricata forum user reported that connecting SELKS to an external Elasticsearch server left Hunting dashboards and events showing no data.Read 15 Oct 2026 · forum.suricata.io
Historical reliability complaint
A SELKS mailing-list thread records Kibana dashboard failures and Elasticsearch mapping errors after shard and configuration changes.Read 15 Oct 2026 · groups.google.com
Included components
SELKS 10 includes Suricata, Elasticsearch, Logstash, Kibana, Stamus Community Edition, and functionality from Arkime, Evebox, and CyberChef.Read 2 Oct 2026 · stamus-networks.com
Independent use case
A university thesis deployed SELKS in VMware, used Suricata for real-time traffic analysis and tested customized rules against crafted IIoT packets.Read 15 Oct 2026 · utupub.fi
Installation duration
A Spanish independent walkthrough reported that the Docker deployment took roughly 10 to 15 minutes after the base installation.Read 15 Oct 2026 · ciberseguridad.blog
Learning curve
The same reviewer said moving from Snort to Suricata involved a noticeable learning curve, although the rule and configuration concepts became familiar.Read 15 Oct 2026 · elysiumsecurity.com
Licence
SELKS is released under the GNU GPL version 3 license.Read 15 Oct 2026 · docs.stamus-networks.com
Minimum resources
The project README lists 2 CPU cores and 9 GB memory as the minimum production configuration.Read 15 Oct 2026 · github.com
Network interfaces
The installation documentation requires a probe VM to have separate management and sniffing interfaces, with the sniffing interface in promiscuous mode.Read 15 Oct 2026 · docs.stamus-networks.com
Notable news
Stamus Networks announced SELKS 10 general availability on June 13, 2024.Read 15 Oct 2026 · stamus-networks.com
Operating systems
The project README says Docker deployment works on Linux or Windows hosts.Read 15 Oct 2026 · github.com
Packet capture
SELKS 10 can capture packets associated with detection events and export session PCAP files for investigation or playback in SELKS or third-party tools such as Wireshark.Read 2 Oct 2026 · stamus-networks.com
PCAP workflow
An independent tutorial used SELKS Docker services and its readpcap script to ingest an AsyncRAT infection capture for analysis.Read 15 Oct 2026 · daniyyell.com
Product status
Stamus Networks announced that SELKS would no longer be actively enhanced from January 1, 2025, while leaving the repository and community resources available.Read 15 Oct 2026 · stamus-networks.com
Protocol visibility
The SELKS 7 release added dashboards covering SNMP, RDP, SIP, HTTP/2, RFB, GENEVE, MQTT and DCERPC.Read 15 Oct 2026 · stamus-networks.com
Rating on G2
The surfaced G2 listing was for related Suricata Turnkey GUI, rated 4.0 out of 5 from 2 reviews; it was not a SELKS product profile.Read 15 Oct 2026 · g2.com
Rule and intelligence management
Its web interface can manage multiple Suricata rulesets and threat intelligence sources, plus custom rules and IoC data files.Read 2 Oct 2026 · stamus-networks.com
Rule management
Stamus Community Edition provides a graphical interface for managing Suricata rulesets and threat-intelligence sources.Read 15 Oct 2026 · my.stamus-networks.com
Scale limit
The maker says SELKS was never designed for enterprise deployment and points enterprise users to its commercial platform.Read 2 Oct 2026 · stamus-networks.com
Security updates
Stamus Networks says it may evaluate community bug-fix requests or pull requests individually, but has no planned SELKS releases after January 1, 2025.Read 2 Oct 2026 · stamus-networks.com
Self-hosting
SELKS is designed for local deployment, including air-gapped ISO installations and Docker Compose on an existing Linux system.Read 15 Oct 2026 · stamus-networks.com
Source code
Source, README, issue tracking and the wiki are hosted in the public SELKS GitHub repository.Read 15 Oct 2026 · my.stamus-networks.com
Support channels
Users are directed to GitHub issues, a Discord channel and the SELKS wiki for assistance.Read 15 Oct 2026 · github.com
Support praise
An independent reviewer described SELKS developer support as proactive and approachable through IRC and GitHub.Read 15 Oct 2026 · elysiumsecurity.com
Threat hunting
The platform supplies predefined hunting filters and interfaces for investigating Suricata alerts and network-security-monitoring events.Read 15 Oct 2026 · github.com

Plans and prices

SELKS Free free and open source · GPL 3.0-or-later · Debian ISO or Docker Compose on Linux Read 15 Oct 2026 · stamus-networks.com

Every SELKS plan and price →

Strong points and limits

Strong points

  • Free and open source under GPL 3.0-or-later.
  • Manages multiple Suricata rulesets and threat intelligence sources.
  • Exports session PCAP files for investigation or playback.
  • Offers Docker Compose and Debian-based ISO deployment options.

Limits

  • No future releases are planned after January 1, 2025.
  • Not designed for enterprise deployment.

Who it suits

SELKS may suit small-to-medium organizations, as well as practitioners, researchers, educators, students, and hobbyists exploring Suricata. Enterprise users should note that the product was not designed for enterprise deployment.

Verdict

SELKS combines Suricata-based detection, monitoring, and hunting tools with packet capture and flexible deployment options. Its legacy status and lack of planned releases are important considerations for ongoing use.

Where Specifiction places it

Alternatives to SELKSAll alternatives →