Suricata is classified as an intrusion detection system (IDS). The system works by scanning through passing network traffic. This makes it a network-based intrusion detection system (NIDS). The other type of IDS is host-based (HIDS) and scans through log files. SIEM combines both of these strategies, so Suricata is a partial SIEM.