Stamus Clear NDR Community

Clear NDR Community is an open source network detection and response system built on Suricata. The platform serves as the successor to the SELKS project and is released under GPL 3.0-or-later license. It is available as a containerized Docker installation using a single Go binary called StamusCtl.

The system integrates multiple open source components including Suricata for network analysis and threat detection, OpenSearch for search and observability, Evebox for alert and event management, Arkime for network analysis and packet capture, and Fluentd for data collection. The platform includes Scirius, a web-based graphical user interface developed by Stamus Networks that manages the entire system.

Clear NDR Community provides network security monitoring and intrusion detection capabilities. The platform includes over 400 visualizations and 58 dashboards for analyzing network traffic and security events. Users can manage multiple Suricata rulesets and threat intelligence sources, upload custom rules and IoC data files, and apply thresholding and suppression to reduce alert noise.

The system supports threat hunting through predefined filters and contextual views. It provides access to Suricata performance statistics and rule activity information. The platform integrates EveBox, Cyberchef, and OpenSearch dashboards for analyzing Suricata NSM and alert data.

Clear NDR Community is designed for small-to-medium sized organizations as a production-grade network security monitoring and intrusion detection solution. It is also used by security practitioners, researchers, educators, and students for exploring Suricata capabilities and analyzing network protocol monitoring logs and alerts.