Suricata

An IDS probe cannot see TLS

Suricata labs built on plain HTTP are excellent for teaching, but they hide a major blind spot once in production: encryption. A promiscuous probe sees TLS and can inspect nothing. Where to place inspection instead.