Suricata is a powerful tool to detect network anomalies based on signatures. However, the data collected by the NIDS are also precious to generate graphs for network defense. During our PhD, we have used Suricata and the Vega tool of the ElasticStack to create parallel coordinates graphs. However, Suricata doesn't yet give information about the direction of the connection (to or from a client to or from a server). This lack leads to a mirror effect in the graph. The flow_direction feature to be shortly merged in Suricata now enables this feature for a proper - and real time - rendering of the network flow diagram. Finally, we have also used Neo4j and Linkurious tool to help for the search and visualization within the metadata stored in Elastic. The use of a graph database makes the requests fast and easy. Linkurious also helps to create easy to understand visualizations of the network flows between clients and servers. Those tools were presented to different SOCs operators with great success.