Configuring the Flowmon IDS Probe

Save PDF

Last Updated: September 16, 2026
6 minute read

Flowmon Products
Flowmon Anomaly Detection System
Documentation

This configuration is available in Settings → IDS Configuration.

The IDS Configuration tab allows you to manage the Flowmon IDS Probe. It contains the following sections: Probes, Rules, Categories, and Configuration.

The Flowmon IDS Probe integrates Suricata, a third-party open-source Intrusion Detection System (IDS), into the Flowmon platform. Suricata inspects network traffic using detection rules called signatures. Each signature describes a threat based on packet content. When traffic matches a signature, the IDS generates an alert.

To reduce resource usage on high-traffic networks, the IDS Probe inspects only the first N packets of each network flow rather than performing full packet capture. By default, 10 packets per flow are inspected (5 from each direction). This limit is configurable in the Flowmon OS.

Note:

The Flowmon IDS Probe package is provided free of charge and is not covered by the Flowmon support service. For information on how to enable the Flowmon IDS Probe, refer to the Flowmon OS User Guide

To configure the Flowmon IDS Probe through Flowmon ADS, the probe must be running version 13.1.0 or later.

Not all Suricata configuration options are available through the ADS interface. For information about Suricata and system-level configuration of the Flowmon IDS Probe, refer to the Flowmon OS User Guide. In the event of conflicts, the configuration set here takes precedence over the configuration set in the Flowmon OS.

Probes

The Probes section displays all registered IDS probes and their current status. The list contains the following columns:

State: the current operational state of the probe, for example Running, Stopped, or Error.
Name: the name of the probe.
Owner: the user who owns the probe.
IDS Probe Server: the hostname or IP address of the IDS probe server, or Use local collector if the local Flowmon Collector is used.

IDS Configuration tab showing registered probes

To add a new IDS probe, click Add. You must fill in the following fields:

Name: a name for the probe.
Use local collector: when enabled, the IDS Probe runs under the Owner account and runs locally. When disabled, remote IDS probe connection settings must be configured.
IDS Probe Server: the hostname or IP address of the remote IDS probe server. This field is only required when Use local collector is disabled.
Login: the username for the remote IDS probe server.
Password: the password for the remote IDS probe server.

Click Test Connection to verify connectivity to the IDS probe server before saving.

Rules

The Rules section displays all custom IDS detection rules. Rules are written in the Suricata rule format and can be used to detect specific traffic patterns.

By default, the IDS Probe uses two rule sources:

Flowmon Services — a Flowmon-hosted copy of the Emerging Threats Open Rules. If the Flowmon Services feed is not reachable, an offline backup is used automatically.
Local rules — any .rules files placed in the local rules directory on the probe are loaded alongside the remote rules.

Rules from both sources are combined and updated automatically. You can add custom rules through the ADS interface, which are applied on top of the default ruleset.

To add a new rule, click Add. You must complete the following fields:

Name: a name for the rule.
Rule: the rule definition, written in the Suricata rule format. To link a rule to a custom category defined in the Categories section, set the classtype keyword to match the category name. For example, if the category is named my-custom-category:
```
alert http any any -> any any (msg:"Example alert"; content:"example"; classtype:my-custom-category; sid:2; rev:1;)
```

Changing or deleting a rule that is used in a configuration automatically triggers a configuration upload to all probes assigned to that configuration. For a complete list of conditions that trigger an automatic push, refer to How configuration is pushed to probes.

For advanced rule management — such as modifying rule actions or adding additional remote rule sources — refer to the Flowmon OS User Guide.

Configuration

The Configuration section allows you to create and manage IDS configurations. An IDS configuration assigns probes, rules, and IP ranges together into a single deployable setup.

To add a new IDS configuration, click Add. You must fill in the following fields:

Name: a name for the IDS configuration.
Probes: the probes assigned to this IDS configuration. A probe can be part of only one IDS configuration at a time.
Disabled Rules: rules that are disabled for this IDS configuration.
Custom Rules: custom rules that are applied within this IDS configuration.
Ranges: the IP ranges used to define HOME_NET for this configuration. HOME_NET tells Suricata which addresses belong to your internal network. Many rules are written to detect threats directed at or originating from HOME_NET, so setting this correctly reduces false positives. You can enter IP addresses, networks (CIDR notation), or ranges, with one entry per line. You can also use the Import from filter option to populate ranges from an existing filter.

For example, to define a typical private network:
```
192.168.0.0/16
10.0.0.0/8
172.16.0.0/12
```
Suricata also derives EXTERNAL_NET automatically as everything outside HOME_NET.

Add IDS Configuration dialog

Clicking a row expands it to show the status of the last configuration apply for each assigned probe, with the following columns:

Probe: the probe to which the configuration was applied.
Timestamp: the date and time when the configuration was last applied.
Status: the result of the last configuration apply, for example, Success.

Status IDS Configuration

How configuration is pushed to probes

A configuration upload to all probes assigned to a configuration is automatically triggered by any of the following:

Creating or editing an IDS configuration.
Editing or removing a custom rule referenced by a configuration.
Adding, editing, or removing a category.

If a probe is deleted or unassigned from a configuration, a clean configuration is automatically pushed to that probe. Deleting the IDS configuration itself has the same effect — a clean configuration is automatically pushed to all probes that were previously assigned to it.

Flowmon ADS User Guide