I’ve seen some changes in the attacks against my firewall too, but so far Suricata has been blocking things. And as you recommended in the video I followed to get me going a year ago, the management interface is not on the WAN. It kind of makes sense to me why some people might want to manage from the WAN, but it also scares me having that open to the public.