For anyone who’s interested in IDS, this is a product that’s open source, with support.

It can be run as a single standalone, but it’s meant to be run tiered, where you can deploy sensors doing packet capture, analysis, which gets sent to a central manager, and then can be retained in search nodes.

It’s incredibly powerful, just have to be willing to learn how to tune it.

https://docs.securityonion.net/en/2.4/ https://blog.securityonion.net/

I am not affiliated with the product, just a user of it. I like it.