[SOLVED] So I enabled Suricata - what now?

[Patrick M. Hausen]

I am successfully running it on the VLAN. IDS mode, only. I am just interested in the statistics, no IPS. Next: investigate the "pfELK" stack to get it all into Elastic.

[abulafia]

In the meantime, you can also have suricataog events as JSON and alert yourself per email through monit (monitoring the JSON file). There is documentation floating around. I could also dig up the config later tonight if needed.