1 · The brief
A six-module course, one major release
The sample course, Suricata IDS/IPS Operations, was written for Suricata 7.0. Suricata 8.0 shipped in July 2025. The job: find everything the release changes, decide how each change is taught, and deliver updated materials an SME can sign off on.
- Step 1Source docs
7.0 and 8.0 references and the upgrade guide.
- Step 2Change inventory
Every change, cited to its section.
- Step 3Decisions
Scope, labs, seat time, audience.
- Step 4Revised materials
Slides, student guide, labs.
- Step 5SME review and QA
Open questions, checklist, beta.
2 · What changed
Thirteen changes, mapped to modules
Each row was checked against the Suricata 8.0 upgrade guide or the 7.0 and 8.0 configuration references. The last two rows are new capabilities added to the course.
| # | 8.0 change | Module | Impact | Decision |
|---|---|---|---|---|
| 1 | Encrypted-traffic bypass no longer depends on stream bypass. | 4 | High | Rewrite the concept section and lab. |
| 2 | SSH gains the same encryption-handling setting as TLS. | 4 | High | Add SSH as a hands-on lab step. |
| 3 | TLS value default deprecated for track-only; removal planned for 9.0. | 4 | High | Replace in every example; add a note. |
| 4 | http-log and tls-log outputs deprecated. | 5 | Medium | Teach EVE first; keep a short note. |
| 5 | Alerts carry app-layer metadata only for rules with app-layer keywords. | 5 | Medium | Add "why is metadata missing?" |
| 6 | stats.whitelist renamed stats.score. | 5, 6 | Low | Update screenshots and tables. |
| 7 | ssh.protoversion and ssh.softwareversion removed. | 3 | Medium | Replace in rule examples. |
| 8 | Most app-layer inspection runs when a request or response completes. | 3 | Medium | Add to troubleshooting. |
| 9 | TCP reassembly triggers earlier. | 3 | Low | Add a tuning note. |
| 10 | from_base64 recommended over base64_decode. | 3 | Low | Update the example rule. |
| 11 | suricatasc and suricatactl rewritten in Rust. | 6 | Low | Re-run every lab command. |
| + | New protocols: SIP over TCP, LDAP, ARP logger, POP3, mDNS, DNS over HTTPS, WebSocket. | 3, 5 | Added | Include in this update. |
| + | Firewall mode (experimental). | 4 | Added | Overview only; no lab yet. |
3 · My decisions
The instructional calls
The documentation says what changed. These decisions say what the course does about it.
Include new capabilities
Most students take one course, so the update covers the whole current release.
Keep the same seat time
Module 1's product overview moves to self-study; beta instructors confirm the timing.
No lab for experimental features
They simulate poorly and can destabilize the lab, so firewall mode is overview only.
Rebuild the lab environment
New 8.0 images; every step and command re-run before beta.
Support students one release behind
Instructor notes cover what students on 7.x will see.
Send open questions to the SME
What the docs don't settle goes to an engineer, not to guesswork.
4 · Revised slides
Module 4, before and after
Two instructor slides as they stood for 7.0 and as revised for 8.0.
5 · SME review and QA
What goes to the engineer, and what gets checked
Questions for the SME
- Does the rebuilt lab reproduce both the 7.0 and 8.0 bypass behavior?
- How do students verify that a TLS or SSH flow was bypassed?
- Which EVE fields replace the deprecated logs?
- Can you provide an alert that lacks app-layer metadata?
- Which keywords replace the removed SSH keywords?
- Is there a rule that stops matching under the new timing?
- Did any command-line tool output change?
- Do the new capture defaults need more lab VM memory?
- Which new protocols belong in which module?
- Will firewall mode still be experimental at release?
QA before beta (highlights)
- Every changed statement traces to a documentation page.
- Every configuration snippet matches the 8.0 reference.
- Lab image rebuilt; every step run end to end and timed.
- Objectives and knowledge checks updated.
- Commands in bold code font; every sentence ends with a period.
- SME sign-off recorded; beta timing confirmed.
6 · How AI was used
Faster comparison, human judgment
Claude compared the 7.0 and 8.0 documentation and drafted the change inventory. I checked each row against the source, removed anything I couldn't confirm, and made every instructional decision.
- Client material goes only into AI tools the client approves; I work fully manually when policy requires it.
- Every change cites a document and section; anything unsourced goes to the SME.
- No command or procedure reaches courseware until it's verified and run on the lab image.
See the change-analysis prompt
You are assisting a senior technical instructional designer with a course update. Inputs: [release notes], [upgrade guide], [product docs for old and new versions], [current course outline, student guide, and lab guide]. Use ONLY these documents. Cite the document and section for every claim. If something is not in the sources, write "Not found in sources." Never invent commands, settings, feature names, or product behavior. 1. Change inventory: Added, Changed, Deprecated, or Removed. 2. Size: Significant, Minor, or Cosmetic. 3. Course mapping: every module, page, slide, and lab step affected, quoting current text. 4. Recommended action: Update, Add, Remove, Note only, or Flag for SME, with a reason. 5. New items the course doesn't cover yet, by exact official name. 6. SME questions the documents don't settle.