I will write custom snort or suricata ids rules for your network

Default IDS rules miss too much. I'll write custom Snort or Suricata rules tailored to your network tuned to reduce false positives and catch real threats.

What I can write rules for:

Port scanning detection (Nmap, SYN floods)

Brute-force login attempts (SSH, FTP, HTTP)

SQL injection and web application attacks

Malware C2 communication patterns

Custom protocol or traffic anomalies

What you get:

Custom .rules file ready to deploy

Each rule commented and explained

Tested in lab environment (Suricata 7 / Snort 3)

False positive reduction advice

1 revision included

I need from you:

Which IDS you use (Snort or Suricata)

What attack types to detect

Your network topology (basic info)

Message me first I'll confirm exactly what's possible for your setup.