SELKS
What it is
SELKS is a free, open-source implementation built around Suricata for network intrusion detection and prevention, security monitoring, and threat hunting. Its web interface can manage multiple Suricata rulesets and threat intelligence sources, as well as custom rules and IoC data files. Predefined hunting filters and contextual views support investigation, while thresholding and suppression can reduce noisy alerts. SELKS 10 includes Suricata, Elasticsearch, Logstash, Kibana, Stamus Community Edition, and functionality from Arkime, Evebox, and CyberChef. It can capture packets linked to detection events and export session PCAP files for investigation or playback in SELKS or other tools. Deployment options include Docker Compose for Linux and Debian-based ISO images, with or without a desktop, on bare metal or virtual machines. SELKS is licensed under GPL 3.0-or-later. Stamus Networks says it stopped actively enhancing the product on January 1, 2025, and has no future releases planned. The maker says SELKS was not designed for enterprise deployment.
For and against
For
- Free and open source under GPL 3.0-or-later.
- Manages Suricata rulesets and threat intelligence sources.
- Includes predefined threat-hunting filters and contextual views.
- Can export session PCAP files for investigation.
- Offers Docker Compose and Debian-based ISO deployment.
Against
- No future releases are planned after January 1, 2025.
- Not designed for enterprise deployment.
The verdict
SELKS combines network monitoring and threat hunting tools with several deployment options at no cost. Its legacy status and lack of planned future releases are important considerations for new deployments.
Who it suits
SELKS may suit small-to-medium organizations and practitioners, researchers, educators, students, or hobbyists exploring Suricata. It is not designed for enterprise deployment.
Plans and prices
SELKS
free and open source · GPL 3.0-or-later · Debian ISO or Docker Compose on Linux
Read 15 Oct 2026 · stamus-networks.com
On the record
- Arkime upgrade
- SELKS 10 added Arkime 5 capabilities including bulk search, improved session details, unified authentication, JA4 support and offline PCAP retrieval improvements.stamus-networks.com · read 15 Oct 2026
- Company founded
- Stamus Networks was founded in 2014.linkedin.com · read 15 Oct 2026
- Company headquarters
- Stamus Networks lists Indianapolis, Indiana as its headquarters.linkedin.com · read 15 Oct 2026
- Company size
- LinkedIn lists Stamus Networks in the 11–50 employee size range.linkedin.com · read 15 Oct 2026
- Conditional packet capture
- SELKS 10 can capture packets associated with detection alerts and export the resulting PCAP evidence.stamus-networks.com · read 15 Oct 2026
- Core components
- The stack includes Suricata, Elasticsearch, Logstash, Kibana and Stamus Community Edition, with Arkime, EveBox and CyberChef added later.stamus-networks.com · read 15 Oct 2026
- Credential complaint
- That walkthrough reported that the documented root password did not work for its installation.ciberseguridad.blog · read 15 Oct 2026
- Dashboards
- The repository describes more than 28 default dashboards, over 400 visualizations and 24 predefined searches.github.com · read 15 Oct 2026
- Database
- SELKS 10 replaced SQLite with PostgreSQL to address known issues and improve scalability.stamus-networks.com · read 15 Oct 2026
- Datasheet requirements
- The SELKS datasheet specifies at least 2 cores, 8–10 GB RAM and 100 GB free disk, recommending high-performance SSD storage.stamus-networks.com · read 15 Oct 2026
- Deployment
- The archive page offers a Docker Compose package for Linux and Debian-based ISO images with or without a desktop, deployable on bare metal or a virtual machine.stamus-networks.com · read 2 Oct 2026
- Deployment methods
- SELKS can run from a Docker Compose package or as Debian-based ISO images on bare metal or virtual machines.stamus-networks.com · read 15 Oct 2026
- Detection and monitoring
- SELKS uses Suricata-generated data for IDS/IPS, network security monitoring, and threat hunting.stamus-networks.com · read 2 Oct 2026
- Documentation depth
- The project wiki includes user setup, Docker and ISO installation, developer build/customization material, tutorials, Splunk documentation and older-version guides.github.com · read 15 Oct 2026
- Enterprise limit
- The README says SELKS is suitable for small and medium organizations but was not designed for enterprise-scale deployment.github.com · read 15 Oct 2026
- External Elasticsearch limit
- A Suricata forum user reported that connecting SELKS to an external Elasticsearch server left Hunting dashboards and events showing no data.forum.suricata.io · read 15 Oct 2026
- Historical reliability complaint
- A SELKS mailing-list thread records Kibana dashboard failures and Elasticsearch mapping errors after shard and configuration changes.groups.google.com · read 15 Oct 2026
- Included components
- SELKS 10 includes Suricata, Elasticsearch, Logstash, Kibana, Stamus Community Edition, and functionality from Arkime, Evebox, and CyberChef.stamus-networks.com · read 2 Oct 2026
