Clear NDR, developed and maintained by Stamus Networks, is one of the most complete open-source network detection and response (NDR) platforms available today. Originally known as SELKS — an acronym for Suricata, Elasticsearch, Logstash, Kibana, and Scirius — the project was rebranded to Clear NDR Community Edition to better reflect its expanded scope and enterprise alignment. It is built on a Debian base and ships as a ready-to-deploy ISO image or Docker Compose stack, making it accessible to both appliance-style deployments and cloud-native environments.
Core Technology Stack
At the heart of Clear NDR is Suricata, the industry-leading open-source intrusion detection and prevention system (IDS/IPS) and network security monitoring engine developed by the OISF. Clear NDR ships with pre-configured Suricata rulesets, and integrates it tightly with the ELK stack — Elasticsearch for storage and indexing, Logstash for log processing, and Kibana for visualization. On top of this, Stamus Networks adds Scirius CE, their open-source rule management interface, which enables security analysts to manage and tune Suricata rule sets through a clean web-based interface. The result is a cohesive, zero-configuration-required NSM platform that can start capturing and analyzing network traffic almost immediately after boot.
Deployment Options
Clear NDR Community Edition can be deployed in three primary ways: as a bootable ISO image for bare-metal or VM appliances, via Docker Compose for containerized environments, and through cloud marketplace images. The ISO approach is ideal for dedicated sensor deployments where a full network tap or SPAN port is required. The Docker Compose path is popular for lab environments and rapid PoC deployments. A production deployment typically requires a server with at least 8 GB of RAM and a dedicated network interface card set to promiscuous mode for traffic capture, with significantly more resources recommended for monitoring high-bandwidth links.
Detection Capabilities
Clear NDR provides multi-layered detection through Suricata's signature-based detection, protocol anomaly detection, and file extraction capabilities. Analysts can leverage the bundled Emerging Threats Open ruleset out of the box, with easy integration for ET Pro, SSLBL, and custom local rules via Scirius. The Kibana-based dashboards provide pre-built views for DNS, HTTP, TLS, flow, alert, and file activity, enabling rapid triage. The platform also supports hunting workflows, where analysts can pivot from aggregate statistics to raw event records with ease.
Community vs. Enterprise
The Community Edition of Clear NDR is fully free and open-source under a GPL/Apache license stack. Stamus Networks also offers a commercial Stamus Security Platform (SSP) that extends Clear NDR with advanced features such as declaration of compromise (DoC) automated analysis, guided threat hunting workflows, multi-sensor management, and enterprise support SLAs. The community edition serves as a capable starting point and is actively used by universities, small SOC teams, and security researchers worldwide. The transition from SELKS to Clear NDR branding was accompanied by meaningful improvements to the installer, the Docker stack, and the default Kibana dashboards, making the platform noticeably more polished than its predecessor.
Performance Considerations
Suricata is highly multi-threaded and can saturate multiple CPU cores on busy network segments. For 1 Gbps monitoring, a 4-core machine with 16 GB RAM and NVMe storage is a practical recommendation. For 10 Gbps environments, Stamus recommends hardware with AF_PACKET or PF_RING capture backends and tuned Suricata configurations. Elasticsearch's indexing demands also scale with traffic volume, and disk I/O becomes the primary bottleneck in high-volume deployments. Clear NDR includes some tuning guidance, but production-grade deployments will require administrator expertise to size and optimize correctly.
Summary
Clear NDR Community Edition fills an important niche as a free, fully integrated NDR platform that bridges the gap between raw Suricata deployments and commercial security appliances. For security professionals, blue teamers, and SOC analysts seeking an open-source alternative to commercial NDR tools, Clear NDR is a compelling, well-supported option with an active development community and a credible enterprise vendor behind it.