Verdix
Verdix

A grounded second opinion on every Suricata alert.

Verdix is an open source AI copilot for SOC analysts running Suricata. It tails your eve.json, correlates the surrounding flow, enriches the indicators, and produces a verdict backed by evidence. It runs as additional Docker Compose services alongside your existing Suricata, on the same host or a separate one.

How it works View on GitHub

See it in action

Verdix triaging a FormBook infection from the sample capture: the queue fills with verdicts, then one alert opens to its full evidence and reasoning.

The problem

A tuned Suricata deployment can still put hundreds of EVE alerts a day in front of a Tier 1 analyst who can't read Suricata rule syntax fast enough to triage them at speed. Volume isn't even the hard part. Each alert is the same dozen manual steps: correlate the flow_id, read the signature, enrich the indicators, work out the real source and target. Verdix does those steps and shows its work.

Accuracy
81.13%
False-negative rate
0.0%

Accuracy is 81.13% on a held-out test set and 78.47% on the development set, measured on a labeled corpus of n = 327 real Suricata alerts split 274 / 53 along source and family boundaries, every verdict at temperature 0. Methodology and corpus are public.

How it works

  • Verdix tails eve.json and indexes the surrounding flow / HTTP / DNS / TLS / file events by flow_id.
  • Verdix enriches indicators with DB-IP Community Edition for ASN and country, reverse DNS for IP-to-hostname mapping, live RDAP for domain registration age and registrar, and VirusTotal for reputation (your VirusTotal API key).
  • Verdix assigns every alert both a network role (initiator, responder) and a security role (attacker, victim). A compromised host calling out to a C2 server is the initiator. It's also the victim. Raw source/destination gets that backwards.
  • Verdix produces a verdict (likely false positive, suspicious, or likely true positive) with confidence, reasoning, and a full evidence chain.
  • Verdix shows an enrichment-source ledger on every alert: what contributed, what's failing, what's not configured.
  • One click to accept or override. docker-compose up and you have a first verdict in under 30 minutes.
  • Verdix analyzes up to 300 alerts per day. Beyond that, alerts are stored and shown in the queue marked deferred, and don't receive a verdict.

Why it's built this way

  • A copilot, never an autopilot. Every verdict is a recommendation: no auto-close, no auto-escalate, no auto-suppress.
  • Runs alongside your existing stack. Stop the containers and your environment is exactly as it was.
  • No payload data leaves the host.
  • Open source under AGPL-3.0.
  • Runs on hardware you already own. No GPU required: 16 vCPUs, 32 GB RAM, and 30 GB disk is the recommended spec. Each verdict takes about two minutes on CPU, or under a minute with a GPU.

Verdix is in early access. It does triage well; everything else is on the roadmap, shaped by the people running it.