This overcomes the blindness that Snort has to get signatures break up in excess of various TCP packets. Suricata waits until most of the details in packets is assembled just before it moves the knowledge into Investigation. OSSEC means Open up Source HIDS Protection. It is the lea