Hardened Suricata 9 engine for AWS. Real-time threat detection and deep packet inspection. Optimized for cloud workloads with professional vendor support and seamless SIEM integration.
Enterprise-Grade Network Security: Hardened for the AWS Cloud In 2026, network visibility is the foundation of a Zero Trust architecture. AdvanceCo Inc provides a production-ready deployment of Suricata 9, the industry leading open-source network threat detection engine, packaged specifically for the Amazon Web Services ecosystem. This AMI removes the operational burden of manual setup. Built on a stable Ubuntu 22.04 LTS foundation, this solution is tuned to leverage AWS features like VPC Traffic Mirroring and Nitro-based instance acceleration. Key Capabilities: Advanced Engine Architecture: Suricata 9 utilizes multi-threading to exploit 100 percent of your multi-core CPU resources. Deep Protocol Analysis: Beyond simple signature matching, Suricata provides metadata extraction for HTTP, DNS, TLS, and SMB traffic. Modern Encryption Visibility: Enhanced handling of QUIC and TLS 1.3 ensures you maintain visibility into modern encrypted streams. Hardened Security: This build includes specific kernel-level optimizations to handle high-velocity traffic spikes without packet loss. The AdvanceCo Advantage: Choosing our supported AMI means you have a partner for your security infrastructure. Our Raleigh-based team provides: Quarterly Maintenance: We handle Ubuntu kernel security patches and Suricata binary updates. SIEM Integration: EVE JSON output is ready for ingestion into any modern observability platform. Performance Tuning: Includes specific configurations not found in community builds for high-throughput networking. Ideal Use Cases: Regulatory Compliance: Quickly satisfy requirements for network monitoring in HIPAA and PCI DSS environments. Cost-Effective Scalability: A powerful alternative to managed firewall services for organizations requiring granular control. Threat Hunting: Use Network Security Monitoring features to analyze network behavior in real-time.
Highlights
Suricata 9 Engine Upgrade: Next-generation visibility for QUIC and TLS 1.3 protocols to secure modern encrypted traffic. Performance Tuned: Pre-configured AF-PACKET settings and 128k block sizes for high-speed AWS networking and reduced CPU overhead.
LDAP and SIP Inspection: Full visibility into lateral movement and voice traffic with native LDAP and SIP over TCP parsers.
Compliance Ready: EVE JSON logging format for instant integration with AWS Security Hub and meeting PCI DSS 4.0 or SOC 2 audits. Professional Support: Includes OS and software maintenance from the AdvanceCo US-based engineering team.
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Suricata 9 IDS-IPS on Ubuntu (Annual Subscription) by AdvanceCo
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covers your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
You pay by the hour for the EC2 instance size you run, under an annual subscription. Each dimension maps to a specific instance type across several families: general-purpose (m5, m7i, m7a, m8i, m8id), flex variants (m7i-flex, m8i-flex), burstable (t3), and bare-metal options (metal-48xl, metal-96xl). Pricing scales with instance capacity, so larger sizes like 96xlarge cost more per hour than smaller sizes like large or medium. You select the instance that fits your network throughput needs and pay only for hours the software runs.
Top-of-mind questions for buyers
What resource does one hourly unit map to for each dimension?
Each dimension maps to one EC2 instance running the software. You pay per hour for that instance size. Larger instance types carry more vCPUs and memory, so they cost more per hour. Metal dimensions run on a dedicated physical server rather than a shared virtual host.
Am I charged when the instance is stopped or powered off?
Software charges apply per hour only while the instance runs. A fully stopped instance stops accruing the hourly software fee. You may still pay underlying AWS charges, such as storage for the attached volume, but the software meters running hours only.
What software support is included with the hourly instance charge?
Standard Support comes with all listings. You get package updates and patches, knowledge base access, upgrade instructions, a community forum, and email support with a 48-hour response target. Priority response, phone support, and dedicated communication channels require a separate support arrangement.
Request a private offer to receive a custom quote.
How can we make this page better?
Tell us how we can improve this page, or report an issue with this product.
Give us feedbackReport a problem with this product or seller
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA).
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Professional Support: Includes OS and software maintenance from the AdvanceCo US-based engineering team.Paid telephone, slack, and software maintenance support is available to customers requiring supported open source products. Find us at https://www.advancecoinc.com/aws-marketplace.html Contact us at secproductsupport@advancecoinc.com
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Hardened Suricata 9 engine for AWS. Real-time threat detection and deep packet inspection. Optimized for cloud workloads with professional vendor support and seamless SIEM integration.
This product has charges associated with it for seller support. Suricata is a high-performance open-source intrusion detection and prevention system (IDS/IPS) that provides real-time network traffic analysis, threat detection, and protocol inspection. It helps organizations identify malicious activity, detect attacks, and enhance network security with advanced rule-based analysis.
This product has charges associated with it for maintenance, updates, and optional technical support provided by the seller. Suricata is a high-performance, open-source network threat detection engine that functions as an Intrusion Detection.
Security Onion is a free and open platform built by defenders for defenders. It includes network visibility, host visibility, intrusion detection honeypots, log management, case management, and much more.
Be the first to review this product. We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.