OPNsense as internal IDS

[lucasasdelli]

Hi all,
a customer of ours needs to run an IDS to log all hacking attempts from inside of his LAN.
I've thought to use OPNsense with only WAN interface, promiscuous mode and switch all-ports mirrored port, but within suricata log I can't see any network attack.

Any thought?
Thanks
Luca