head to head · open source
suricata vs Tirreno
suricata has 6,816 GitHub stars, 1,782 forks, 86 open issues and last shipped yesterday. Tirreno has 1,561 stars, 186 forks, 9 open issues and last shipped 12 days ago. suricata leads on adoption by 337% (6,816 vs 1,561 stars). suricata is written in C under GPL-2.0; Tirreno is written in PHP under AGPL-3.0. suricata has attracted 26% as many forks as stars, Tirreno 12%. suricata was the more recently maintained of the two, and both are self-hostable with no licence fee.
Two open source projects, one decision. Both are free and self-hostable — the differences are community size, license terms, language stack and release pace.
← all 20902 open source comparisons
Side by side
| suricata | Tirreno | |
|---|---|---|
| GitHub stars | ★ 6.8K | ★ 1.6K |
| License | GPL-2.0 | AGPL-3.0 |
| Written in | C | PHP |
| Last push | 2026-11-04 | 2026-10-24 |
| Forks | ⑂ 1.8K | ⑂ 186 |
| Self-hosting | Yes | Yes |
| Data ownership | Your server | Your server |
pick suricata if
- You weight community size — 6.8K stars and counting
- You want the GPL-2.0 license terms
- Your stack matches C
- You value the larger contributor base for long-term maintenance
pick Tirreno if
- You want the Tirreno feature set and don't need the biggest community
- You prefer the AGPL-3.0 license terms
- Your stack matches PHP
- You evaluated both and Tirreno fits your workflow better
About suricata
Suricata Introduction Suricata is a network IDS, IPS and NSM engine developed by the OISF and the Suricata community. Resources Home Page Bug Tracker User Guide Dev Guide Installation Guide User Support Forum Contributing We're happily taking patches and other contributions. Please see our Contribution Process for how to get started. Suricata is a complex piece of software dealing with mostly untrusted input. Mishandling this input will have serious consequences: in IPS mode a crash may knock a network offline in passive mode a compromise of the IDS may lead to loss of critical and confidential data missed…
read the full suricata overview →
About Tirreno
tirreno tirreno is a security framework. tirreno [tir.ˈrɛ.no] helps understand, monitor, and protect your product from threats, fraud, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised accounts and application logic abuse that bypasses firewalls, SIEM, WAFs, and other defenses. tirreno detects threats where they actually happen: inside your product. tirreno is a hand written, few dependency, "low tech" PHP/PostgreSQL application. After a straightforward five minute installation, you can ingest events through API calls and immediately…
read the full Tirreno overview →
More in Security & Privacy
Related comparisons
More Network Security projects
Compare either of these against the rest of the Network Security field.
Frequently asked questions
Is suricata or Tirreno more popular?
suricata has 6,816 GitHub stars and Tirreno has 1,561. suricata has the larger community by that measure.
Are suricata and Tirreno free?
Both are open source. suricata is licensed under GPL-2.0 and Tirreno under AGPL-3.0. Neither carries a licence fee.
What is the difference between suricata and Tirreno?
suricata is written in C and Tirreno in PHP. The practical differences are community size, licence terms, language stack and release cadence — all compared in the table above.
Which should I choose, suricata or Tirreno?
Choose suricata if you want the larger community (6,816 stars) or its GPL-2.0 licence terms. Choose Tirreno if its feature set, stack or AGPL-3.0 licence fits better. Both are self-hostable.