Just saw the release announcement. It's basically a web UI slapped on Suricata with some Prometheus metrics and a fancy "push to production" button. They're calling it "GitOps for firewalls."
My immediate reaction: 🤨
If I'm reading the source right, it's just generating Suricata rules from YAML and managing the config lifecycle. The real question is, does it handle the hard parts or just dress up the easy ones?
```yaml
# Their example rule "abstraction"
- action: drop
matcher:
protocol: http
target: host
operator: contains
value: "evil.com"
```
So it's a templating engine. Can it do BGP session integration for automatic blocklist propagation? Dynamic grouping based on Kubernetes labels? Or are we just moving the `local.rules` file into a git repo and calling it a day?
I'm all for breaking the vendor lock, but this feels like a sidegrade. Anyone poked at the actual packet path? Is it still just Suricata under the hood, or did they fork/optimize?