Threat Detection & IPS/IDS

Intrusion prevention with Suricata rules

Firecradle watches every connection for port scans, DDoS floods, protocol anomalies, and known malware signatures - then hands you a severity-ranked alert queue you can act on, acknowledge, and export. Detection runs Suricata rules and is rule and signature based. Firecradle is in development (alpha).

🔎 Rule & signature-based - not a black-box AI model

What Firecradle Detects

Four alert types, each backed by a defined rule or signature - no unexplainable model output.

Port Scan
Multiple connection attempts against blocked or unusual ports from a single source - the classic reconnaissance pattern.
DDoS
Abnormal volumes of traffic aimed at overwhelming an interface, service, or connection table.
Anomaly
Traffic that deviates from expected connection or protocol patterns - flagged for review even without a known signature.
Malware
Traffic matching a known-bad signature - command-and-control beacons, exploit attempts, and other identified threats.

Severity, Triaged for You

Every alert lands in one of four severity tiers, so the team knows what to look at first.

Low
Informational - worth a look, no immediate action required.
Medium
Suspicious pattern that warrants investigation.
High
Active probing or a confirmed signature match - review promptly.
Critical
Active attack in progress - immediate attention needed.

From Detection to Acknowledgment

Every alert follows the same lifecycle - detected, actioned, surfaced, and acknowledged by an operator.

Alert Lifecycle
Detected
A rule or signature matches live traffic. An alert is created with type, severity, source IP, and packet count.
Action Taken
Depending on mode, the matching traffic is logged or actively blocked at the firewall.
Surfaced
The alert appears on the dashboard with full detail - description, timestamp, and packets observed.
Acknowledged
An operator reviews and acknowledges the alert, marking it reviewed for the audit trail.
Sample Alert Record
Type
port_scan
Severity
medium
Source IP
203.0.113.99
Packets
245
Action taken
blocked
Acknowledged
false
Description
Multiple connection attempts to blocked ports
AcknowledgeExport Log

Optional Community Threat-Intel Sharing

Appliances can optionally contribute anonymized signature hits to a shared community knowledgebase, helping newly observed attack patterns get codified into rules and signatures faster across the fleet. Participation is opt-in and controlled per appliance - nothing is shared unless you turn it on.

Real-World Use Cases

Reconnaissance Before an Attack

A source IP starts probing sequential ports looking for an open service.

✅Port scan alert raised after the pattern crosses the detection threshold
✅Severity set to medium and surfaced on the dashboard immediately
✅Source IP and packet count logged for the security team to review
✅Operator acknowledges the alert once reviewed

Volumetric Traffic Spike

A sudden flood of connection attempts threatens to exhaust the connection table.

✅DDoS alert raised as critical severity
✅Offending traffic blocked at the firewall automatically
✅Full packet and timestamp detail available for log export
✅Statistics dashboard shows the spike alongside historical baselines

Key Advantages

✅Transparent detection: every alert traces to a defined rule or signature, never an unexplainable model
✅Four alert types covered: port scans, DDoS, anomalies, and malware signatures
✅Severity-ranked queue: low to critical, so the team knows what to review first
✅Full audit trail: acknowledge alerts and export logs for compliance evidence
✅Community-fed: optional, opt-in signature sharing keeps detection current

See Every Threat Before It Becomes a Problem

Rule and signature-based intrusion prevention included in every Firecradle appliance.

In development · early access · Onboarded hands-on by our team