--- title: The third SELKS is out description: The third SELKS is out image: https://www.stamus-networks.com/hubfs/Imported_Blog_Media/correlate-alerts.png --- [![Stamus-Logo-with-R-color-small](https://www.stamus-networks.com/hubfs/Stamus-Logo-with-R-color-small.png "Stamus-Logo-with-R-color-small")](https://www.stamus-networks.com/?hsLang=en) # The third SELKS is out by [Peter Manev](https://www.stamus-networks.com/blog/author/peter-manev) | Aug 12, 2016 | [SELKS](https://www.stamus-networks.com/blog/tag/selks), [Open Source](https://www.stamus-networks.com/blog/tag/open-source), [Suricata](https://www.stamus-networks.com/blog/tag/suricata), [Stamus Labs](https://www.stamus-networks.com/blog/tag/stamus-labs) ![](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/correlate-alerts.png) Yes, we did it: the most awaited SELKS 3.0 is out. This is the first stable release of this new branch that brings you the latest Suricata and Elastic stack technology. SELKS is both Live and installable Network Security Management ISO based on Debian implementing and focusing on a complete and ready to use Suricata IDS/IPS ecosystem with its own graphic rule manager. Stamus Networks is a proud member of the Open Source community and SELKS is released under GPLv3 license. [![Suricata page in Scirius](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Scirius-1-300x139.png?width=300&height=139&name=Scirius-1-300x139.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Scirius-1.png?hsLang=en) Suricata page in Scirius #### Main changes and new features ##### Suricata 3.1.1 SELKS 3.0 comes with latest Suricata namely 3.1.1 bringing a big performance boost as well as some new IDS and NSM capabilities. ##### Elasticsearch 2.x and Kibana 4 But the main change in SELKS 3.0 is the switch to the latest generation of the Elastic stack. On user side this means Kibana 3 has been replaced by Kibana 4. And this really means a lot. Kibana 4 is a complete rewrite of Kibana 3 being non backward compatible on data side. So, our team had to redo from scratch all dashboards and visualizations. The result is a new set of 11 ready-to-use dashboards and a lots of visualizations that you can use to build your own dashboards. [![Kibana Alert dashboard](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Screenshot-from-2016-05-30-17-41-36-300x154.png?width=300&height=154&name=Screenshot-from-2016-05-30-17-41-36-300x154.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Screenshot-from-2016-05-30-17-41-36.png?hsLang=en) Kibana Alert dashboard [![correlate-alerts](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/correlate-alerts-300x90.png?width=300&height=90&name=correlate-alerts-300x90.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/correlate-alerts.png?hsLang=en) Complete flow and rule correlation view of an alert ##### Latest Scirius Community Edition On the ruleset management side, SELKS 3.0 comes with Scirius Community Edition 1.1.10 that has support for advanced Suricata feature like xbits. [![Thresholding](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Thresholding-300x93.png?width=300&height=93&name=Thresholding-300x93.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Thresholding.png?hsLang=en) Suppression with Scirius [![Thresholding-1](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Thresholding-1-300x155.png?width=300&height=155&name=Thresholding-1-300x155.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Thresholding-1.png?hsLang=en) Threshold and suppress ruleset view with Scirius [![Thresholding-2](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Thresholding-2-300x90.png?width=300&height=90&name=Thresholding-2-300x90.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Thresholding-2.png?hsLang=en) Thresholding with Scirius Scirius CE also brings thresholding and suppression support as well as an integrated backup system which allows for back up to be done (besides locally) in locations such as : - FTP - Amazon AWS - Dropbox ##### Evebox SELKS 3.0 comes with Evebox an alert management/viewer/report interface for Suricata that presents events as a mailbox to provide classification via acknowledgement and escalade. [![Mailbox view in Evebox](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Screenshot-from-2016-08-12-08-48-20-300x137.png?width=300&height=137&name=Screenshot-from-2016-08-12-08-48-20-300x137.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Screenshot-from-2016-08-12-08-48-20.png?hsLang=en) Mailbox view in Evebox One of the other interesting features of Evebox is the capability to create and export pcap generated from events: [![Pcap-1](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Pcap-1-300x138.png?width=300&height=138&name=Pcap-1-300x138.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Pcap-1.png?hsLang=en) Payload pcap generation (Evebox) [![Pcap-2](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Pcap-2-300x151.png?width=300&height=151&name=Pcap-2-300x151.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Pcap-2.png?hsLang=en) Payload pcap generation (Evebox) #### Features list - [Suricata IDS/IPS/NSM ](http://suricata-ids.org/) - Suricata 3.1.1 packaged. - [Elasticsearch 2.3.5](https://www.elastic.co/products/elasticsearch)  - latest available ES edition featuring speed, scalability, security improvements and more. - [Logstash 2.3.4](https://www.elastic.co/downloads/logstash) - performance improvement ES 2.3 compatability, dynamically reload pipelines on the fly and more - [Kibana 4.5.4](https://www.elastic.co/downloads/kibana) - taking advantage of the latest features and performance improvement of ES - [Scirius 1.1.10](https://github.com/StamusNetworks/scirius#scirius) - support for xbits, hostbits, thresholding, suppression, backup and more - [Evebox](https://github.com/jasonish/evebox) - alert management/viewer/report interface for Suricata/ES  allowing easy export of payload/packets into pcaps - [4.4.x longterm kernel](https://www.kernel.org/) - SELKS 3.0 comes by default with 4.4.16 kernel. - Dashboards - reworked dashboards with flow and rule correlation capability. SELKS comes with 11 ready to use Kibana dashboards. More than 190 visualizations are available to mix, match, customize and make your own dashboards as well. Please feel free to try it out, spread the word, feedback and let's talk about SELKS 3.0. #### To get you started Once downloaded and installed, you can get access to all components via [https://your.selks.IP.here/](https://your.selks.IP.here/rules/) The default user and password for both web interface and system is: - user: `selks-user` - password: `selks-user` The default root password is `StamusNetworks`. Please note that in Live mode the password for the selks-user system user is `live`. #### Upgrades There is no direct upgrade path from SELKS 2.0 to SELKS 3.0 due to a number of breaking and compatibility changes in Elasticsearch 1.x to 2.x and Kibana 3.x to 4.x. The only proposed upgrade path is [SELKS 3.0RC1 upgrade to SELKS 3.0](https://github.com/StamusNetworks/SELKS/wiki/SELKS-3.0RC1-to-SELKS-3.0-upgrades) #### More about SELKS 3.0 - [Download SELKS 3.0](https://www.stamus-networks.com/open-source/?hsLang=en#selks) - Get help on Freenode IRC on the #SELKS channel and/or  [Google Mailing list](http://groups.google.com/d/forum/selks). [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png) ](https://www.facebook.com/share.php?u=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2016%2F08%2F12%2Fthe-third-selks-is-out%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png) ](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2016%2F08%2F12%2Fthe-third-selks-is-out%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2016%2F08%2F12%2Fthe-third-selks-is-out%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2016%2F08%2F12%2Fthe-third-selks-is-out%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png) ](mailto:?subject=Check+out+https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2016%2F08%2F12%2Fthe-third-selks-is-out%3Futm_medium%3Dsocial%26utm_source%3Demail&body=Check+out+https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2016%2F08%2F12%2Fthe-third-selks-is-out%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Peter Manev](https://www.stamus-networks.com/hubfs/Stamus_Peter_Square-1.jpg) #### Peter Manev Peter Manev is the co-founder and chief strategy officer (CSO) at Stamus Networks. He is a member of the executive team at Open Network Security Foundation (OISF). Peter has over 20 years of experience in the IT industry, including enterprise-level IT security practice. He is a passionate user, developer, and explorer of innovative open-source security software, and he is responsible for training as well as quality assurance and testing on the development team of Suricata – the open-source threat detection engine. Peter is a regular speaker and educator on open-source security, threat hunting, and network security at conferences and live-fire cyber exercises, such as Crossed Swords, DeepSec, Troopers, DefCon, RSA, Suricon, SharkFest, and others. Peter resides in Gothenburg, Sweden. [**](https://www.linkedin.com/in/peter-manev-64918336/) [** ](https://twitter.com/pevma) ## Schedule a Demo of Clear NDR [![REQUEST A DEMO](https://no-cache.hubspot.com/cta/default/6344338/a3da5fbf-412c-4e3f-a140-f6f33ed8cc5f.png)](https://cta-redirect.hubspot.com/cta/redirect/6344338/a3da5fbf-412c-4e3f-a140-f6f33ed8cc5f) ## Related posts [![Suricata Language Server 2.0 Now Available from Stamus Networks](https://www.stamus-networks.com/hubfs/SN-SLS-2-Blog-Featured.jpg) ](https://www.stamus-networks.com/blog/suricata-language-server-2.0?hsLang=en) ### [Suricata Language Server 2.0: Major Update with Workspace Intelligence](https://www.stamus-networks.com/blog/suricata-language-server-2.0?hsLang=en) We're excited to announce version 2.0 of the Suricata Language Server, featuring workspace-wide... [![Suricata Language Server 1.3.0: Automated PCAP Testing, Multi-Version Support, and Syntax Highlighting](https://www.stamus-networks.com/hubfs/SLS-1.3-18-Dec-2025.jpg) ](https://www.stamus-networks.com/blog/suricata-language-server-1.3-automated-pcap-testing-and-multi-version-support?hsLang=en) ### [Suricata Language Server 1.3.0: Automated PCAP Testing, Multi-Version Support, and Syntax Highlighting](https://www.stamus-networks.com/blog/suricata-language-server-1.3-automated-pcap-testing-and-multi-version-support?hsLang=en) [Suricata Language Server](https://www.stamus-networks.com/suricata-language-server?hsLang=en) 1.3.0 is now available and it surfs on the concept of magic comment... [![](https://www.stamus-networks.com/hubfs/SLS-1.1.0-13-Nov-2025.jpg) ](https://www.stamus-networks.com/blog/suricata-language-server-1.1.0-reduces-installation-requirements-with-docker-container-mode?hsLang=en) ### [Suricata Language Server 1.1.0 Reduces Installation Requirements with Docker Container Mode](https://www.stamus-networks.com/blog/suricata-language-server-1.1.0-reduces-installation-requirements-with-docker-container-mode?hsLang=en) Writing and validating Suricata signatures shouldn't require wrestling with complex installation... [![Stamus-Logo-with-R-white](https://www.stamus-networks.com/hs-fs/hubfs/Stamus-Logo-with-R-white.png?width=2000&height=536&name=Stamus-Logo-with-R-white.png "Stamus-Logo-with-R-white")](https://www.stamus-networks.com/?hsLang=en) ABOUT STAMUS® NETWORKS Stamus Networks is the network intelligence foundation for AI-powered security operations and the creator of the Clear NDR® system. Built on Suricata, the world's leading open-source network security engine, Clear NDR transforms raw network traffic into actionable security insights with unmatched transparency, customization, and effectiveness. Designed to close visibility gaps and reduce alert fatigue, Clear NDR is trusted by leading financial institutions, government agencies, and has been battle-tested over ten years in NATO's largest cybersecurity exercises. Stamus Networks empowers security teams with greater control, fewer false positives, faster response times, and a more responsive, open approach than legacy vendors. - [**](https://www.linkedin.com/company/stamus-networks) - [**](https://twitter.com/StamusN/) - [**](https://www.youtube.com/Stamus-Networks) - [* *](https://discord.gg/JUMSU9uA) - Paris, FranceIndianapolis, USA **[contact@stamus-networks.com](mailto:contact@stamus-networks.com) [Privacy](https://www.stamus-networks.com/privacy-policy?hsLang=en) © 2014-2026 Stamus Networks, Inc. All rights Reserved.