# Source: https://docs.datadoghq.com/security/default_rules/def-000-0w8.md

---
title: Suricata anomaly detected from source IP address
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Suricata anomaly detected from source
  IP address
---

# Suricata anomaly detected from source IP address
Classification:anomaly 
## Goal{% #goal %}

Detect when Suricata raises an anomaly based detection.

## Strategy{% #strategy %}

The rule monitors the anomaly type of Suricata log for when there is an anomaly detected from a source IP address.

## Triage and response{% #triage-and-response %}

1. Investigate the anomaly generated from `{{@network.client.ip}}` by anomaly type - `{{@anomaly.type}}` and anomaly event name - `{{@anomaly.event}}`
1. Examine the reassembled traffic to understand the nature of the anomaly and determine if the anomaly is due to benign network issues or malicious activity.
1. If the anomalies are deemed malicious, take steps to block the offending traffic and strengthen network defences.