SELKS

SELKS is a free, self-hosted network security implementation built around Suricata. It suits practitioners and smaller organizations that can run their own tools, but not teams that need a continuing release roadmap.

Overview

SELKS brings intrusion detection and prevention, network security monitoring, and threat hunting together in a turn-key package. Its open-source GPL 3.0-or-later license and support for inline blocking and encrypted traffic inspection make it a broad option for network-focused security work without a license fee.

The major qualification is its lifecycle: Stamus Networks stopped actively enhancing SELKS on January 1, 2025, and has no future releases planned. The maker may consider community bug fixes or pull requests individually, but that is not a predictable update path. SELKS is therefore easier to justify for learning, research, or deployments able to accept a static product than for operations that depend on ongoing development.

Key features

SELKS works from Suricata-generated data for IDS/IPS, monitoring, and hunting. Its web interface manages multiple Suricata rulesets and threat intelligence sources, as well as custom rules and IoC data files. Predefined hunting filters and contextual views give practitioners useful starting points for investigations; thresholding and suppression help control alert noise.

SELKS 10 includes Suricata, Elasticsearch, Logstash, Kibana, Stamus Community Edition, and functionality from Arkime, Evebox, and CyberChef. It can capture packets associated with detection events and export session PCAP files for investigation or playback in SELKS or tools such as Wireshark. That adds a concrete path from alert to packet-level review, though it also means operators are adopting a multi-component stack rather than a narrowly scoped sensor.

Pricing

SELKS — free. The plan is free and open source under GPL 3.0-or-later, with no paid tier or license cost described. It does not trade away a cheaper plan's features; the important cost is operational responsibility, especially given the lack of planned releases. There are no stated seat, quota, or trial limits.

Platforms

SELKS is self-hosted software for Linux deployment. The archive offers a Docker Compose package for Linux and Debian-based ISO images with or without a desktop, suitable for bare metal or a virtual machine. Windows and web are also listed as platforms, but the documented deployment packages are Linux-oriented.

Who it's for

Stamus Networks describes SELKS as suitable for many small-to-medium organizations and says practitioners, researchers, educators, students, and hobbyists use it to explore Suricata. Its bundled components and hunting workflow can serve teams that want more than raw Suricata, provided they are prepared to operate the deployment themselves and accept its legacy status.

It is not an enterprise-scale choice: Stamus says SELKS was never designed for enterprise deployment and points enterprise users to its commercial platform. The maker directs users to GitHub for documentation, issues, and the wiki, and to Discord for questions and help. Community channels may help with use, but they do not change the release outlook.

Pros and cons

• Pros: Free GPL-licensed software combines Suricata-based detection, monitoring, and hunting, with rule and intelligence management in a web interface.
• Pros: Event-linked packet capture and PCAP export support deeper investigation and replay in other tools.
• Cons: No future releases are planned after January 1, 2025, limiting its appeal where ongoing maintenance is a requirement.
• Cons: It was not designed for enterprise deployment, narrowing its fit for large-scale security operations.

Alternatives

For another network intrusion and prevention option, compare the Intrusion Detection and Prevention Software category. Suricata is the more direct choice for teams seeking the free, open-source engine itself rather than SELKS's bundled implementation. Wazuh offers a free self-hosted open-source plan and a paid Small plan at $571 a month, making it an alternative for readers comparing a broader freemium product structure.

CrowdSec has a free Community plan with three blocklists and a paid IP Reputation API at $49 a month, so it is worth considering when those offerings better match the need. OSSEC offers a free command-line plan with core rules and no dedicated support staff. Arista NG Firewall has a free plan for basic security and connectivity features with limited capabilities. IPFire is a free, open-source firewall operating system without feature tiers or license renewals. OPNsense offers a free Community Edition alongside paid Business Edition options. pfSense offers community and Plus software editions for firewall and router use.

Verdict

Choose SELKS if you want a free, self-hosted Suricata-based stack for network detection, monitoring, and hunting, especially for learning or smaller deployments. Its integrated investigation tools are a strong reason to choose it over using Suricata alone. Look elsewhere if your organization needs enterprise scale or a dependable stream of future releases.