Intrusion Detection System, a system for detecting and alerting based on behavior.

learn more… | top users | synonyms (2)

0
votes
1answer
27 views

Windows SQL Server Intrusion Detection [on hold]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
13
votes
4answers
44k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...
3
votes
1answer
31 views

Host Based Prevention System definition

I'm a little bit confused about what a host-based intrusion prevention system is. In order to better understand this concept, I'd like to introduce you a case. Let's say someone designed the ...
5
votes
1answer
152 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
0
votes
0answers
14 views

Bluecoat sc-filter-result: DENIED but s-action: ALLOWED [migrated]

I have a bluecoat server which sometimes creates rows which don't make sense: { ... "sc-filter-result": "DENIED", "s-action": "ALLOWED" } How is it possible to be both DENIED and ALLOWED?
1
vote
1answer
37 views

Use of server and root certificate in ssl termination and inspection

I'm researching vendors which allow SSL termination and inspection, I came across Cisco CWSA technology, the technology was somewhat easy to understand the stuff which really boggled my mind was the ...
2
votes
1answer
28 views

SNORT sfportscan alert format

How can I modify the output alert from sfportscan ? Ex : output alert_csv: /var/log/snort/portscan.log timestamp,src,dst,dstport,msg OBS: I can set output for default alert file with this method ?
4
votes
3answers
1k views

Published data sets for IDS/IPS evaluation

I am looking for data sets published by researchers or freelancers which can be used for the purpose of IDS/IPS testing and evaluations. The data sets may be for portscans, DoS attacks, Remote to ...
2
votes
0answers
53 views

Help locate “snot” IPS/IDS testing tool? [closed]

It seems this great tool has been lost to internet backlog somewhere. I cannot locate it anywhere. The description of tools provided is http://www.securityfocus.com/tools/category/112 If someone on ...
1
vote
3answers
132 views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
3
votes
3answers
109 views

Browser as Honey-Pot, is there?

I'm watching all this movement around Metasploit project, the great number of different exploitation plugins, and thousands of exploit packs. Now, it is real truth, anyone could configure his own ...
1
vote
2answers
196 views

Can I connect to a network without being detected? [closed]

Some people use software like whoisonmywifi and so on. Is there a way to bypass this software? I think it pings all IP addresses like 192.168.1.0/24 so it will ping all addresses. Can I disable ...
1
vote
1answer
14 views

Query on IPS reports

In the IPS reports i see multiple counts of the same exploit from the same source ip. I wonder why would someone continue to attempt exploiting a vulnerability when he must have realized in the first ...
0
votes
1answer
37 views

Nil events in IPS reports today [closed]

The IPS reports have one or two events minimum every day so far. But today there were no events, both in DC1 and DC2 reports. I am wondering if this possible? How come on a particular day nobody ...
0
votes
1answer
68 views

Intrusion Detection System and Network Intrusion Detection Systems [duplicate]

IDS (Intrusion Detection System), NIDS (Network Intrusion Detection System) What's the difference between IDS and NIDS? Can i use more than one IDS and NIDS at the same time? Or both IDS and NIDS ...
2
votes
0answers
56 views

I'm looking for a decent book on network and infrastructure security [closed]

I'm currently looking for a decent book on network and infrastructure security (especially in the enterprise context). Could you point me to one or two recent books, please? Thanks a lot in advance! ...
0
votes
2answers
72 views

How to make sense of, and act on, Snort Rules?

I am a relatively new Snort user with years of sys admin experience. I feel that I must be missing something, because I find Snort rules to be completely undocumented and incomprehensible. Because of ...
0
votes
1answer
75 views

Snort - Rule: Alert all php requests

I am trying to understand writing rules for snort. Further goal is detection of sql injections like here. I've read the documentation of snort rules and created this rule: alert tcp any any -> ...
0
votes
0answers
19 views

Security Data Analytics - Classical Measurements/Metrics

for my new Job I have to prepare information about how Security Data Analysis is actually use in practice. So my question is if someone can provide me with measurements/metrics/queries (don't really ...
1
vote
3answers
2k views

Power friendly home router, firewall, IDS/IPS setup? [closed]

For those that like to manage their own firewall and run IDS/IPS on their home networks, I'm curious - what are you using and is it power friendly? I used to have a shelf full systems doing various ...
1
vote
0answers
42 views

How to test OSSEC HIDS using a linux dataset containing raw system call traces?

I have been tasked to test effectiveness of OSSEC HIDS (by effectiveness I mean detection rate it achieves as well as false positives rate) when a dataset of raw system call traces are used. The ...
0
votes
2answers
252 views

NIDS/NIPS vs HIDS/HIPS

Can we interchangeably deploy a HIDS or HIPS instead of a NIDS/NIPS, what would be the risks, for example you have Symanetec EPS modules with HIPS policies enabled how are they different from a ...
5
votes
1answer
2k views

New to ossec - what does active response do out of the box

I am new to ossec. I installed the server and wui on a dedicated machine. I have agents running on my zookeeper and kafka servers to start. Below are events I am seeing. I assume the are ...
3
votes
2answers
289 views

Security model for datacenters

I have several datacentres and now I want to plan security for it, so it's resilient to external attacks. I need to make a security model which will cover my web servers, auth servers, log servers, ...
1
vote
0answers
79 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
8
votes
4answers
694 views

Evading IDS in exploit development

In the context of buffer overflow exploit development, I was asked: Discuss how your exploit may be modified to evade an Intrusion Detection System. I'm not asking for my homework to be done, but ...
5
votes
2answers
2k views

Event monitoring for a home network

I'd like to utilise some of the free SIEM type products out there to increase the chances that I will detect attacks and compromises of any of the devices on my home network. Most of my home devices ...
0
votes
2answers
65 views

Security devices other than firewall and IDS [closed]

I was just studying about firewalls and IDS/IPS and had a doubt. Are these the only two major security devices that a company invests in? or are there other equipment and security controls?
6
votes
3answers
697 views

Can the IPS technology in a UTM prevent a DDoS attack?

Does a Unified Threat Management appliance (UTM) with Intrusion Prevention (IPS) enabled have the ability to prevent a DDoS attack? I have read some articles and none of them have a perfect ...
0
votes
1answer
88 views

Snort: Arpspoof preprocessor events not showing up in BASE UI

I have followed this guide to install Snort, using Barnyard2, BASE, IIS, and MySql. My Snort is up & running and loads of events are being logged. After weeding out some false positives, I wanted ...
2
votes
0answers
125 views

Snort alerts analysis (web interface) [closed]

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
0
votes
1answer
34 views

Call For papers format help [closed]

I’m intending to submit a personal project for a “call for papers” for an upcoming Con. I have a really interesting topic that I wanted to submit for the talk. I was hoping to gain some feed back on ...
-1
votes
1answer
139 views

Can Snort be configured as HIDS?

I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS. I want to know is there any way I can configure Snort as an HIDS? If I am ...
-1
votes
2answers
81 views

Detecting malicious domains/URLs [closed]

Do state of the art commercial URL threat intelligence feeds ( for example, one's by Symantec, Intel-security etc) miss malicious domains? (i.e. domains serving malware,exploit code & phishing ...
1
vote
0answers
202 views

OSSEC not detecting deleted files?

I have configured 3 VMs: ossec server and two agents in CentOS 6 and Windows 2k8 R2. I have completed the setup and FIM and Log Management works smoothly. It also reports the new files. However, it ...
1
vote
1answer
245 views

OSSEC New Install: Scan and analyse full log?

When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
1
vote
2answers
176 views

How to properly configure OSSEC for Web Application Security ?

I would like to implement OSSEC as HIDS on my server, but by default OSSIC monitors a number of folders. I am going to deploy a web application on my server. So what should be my default OSSEC ...
2
votes
2answers
457 views

OSSEC on an existing running machine

I am setting up a OSSEC on existing running machine. From my research I find that I should be running the following command to check for previous intrusion. zcat /var/log/*.gz | ...
1
vote
3answers
95 views

IDS over HTTPS connection

I am designing an anomaly-based intrusion detection system in java. It basically consists of a sniffer that identifies HTTP header fields and then analyze them according to a previous configured XML ...
2
votes
1answer
54 views

I want to filter Snort rules by date written [closed]

I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?
0
votes
1answer
68 views

Customize an Intrusion Detection System for serial communication

Most of the Intrusion detection Systems I know of is for IP Communication. But, lets assume that I have serial communication, i.e. CAN or RS485. On this serial Communication there are customized ...
0
votes
1answer
212 views

Is it possible to detect a keylogger, when placed? [duplicate]

Can you detect a keylogger when it is placed? Would it be possible to do that via a keyboard removed event, expecting the keyboard is not removed regularly? So that you for example get a pop-up/alert ...
2
votes
0answers
75 views

Decrypt TLS from an IDS

So I am trying to figure out what the packet payload is off of a possible TLS HeartBleed alert from my IDS. I have read that Wireshark is able to do it with some certain keys, but isn't that in real ...
0
votes
0answers
180 views

problem with my snort rule

I have written this rule but when I try to reload Snort it is failing. I have commented out the rule and reloaded snort; it is working so I know it's the rule. alert tcp any any -> any 5466 ...
8
votes
1answer
228 views

Setting up own enterprise SOC

the other day I was talking with a service provider (MSSP) who have experience with operating SOC (security operations centre) 24x7. Their price was rather steep (in the millions range). I don't ...
-6
votes
1answer
68 views

network IDS capabilities for attack detection [closed]

Is a Network Intrusion Detection System (NIDS) (pattern matching, protocol analysis or behavior analysis) able to detect buffer overflow in the network traffic?
1
vote
1answer
636 views

How to configure Suricata to not interfere with virtual machine [closed]

I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
1
vote
1answer
63 views

Using snort with cloudflare? [closed]

How might Snort or another IDS system work with Cloudflare? Essentially, the originating IP would be CloudFlare's, therefore a proactive IPS might be difficult to install. I understand that ...
1
vote
2answers
225 views

Botnet callback patterns

I am trying to understand the network behavior of bots. Are there any identifiable characteristics of callback requests from the bot to the C&C server which differentiates it from normal traffic? ...
1
vote
3answers
159 views

Why Bash Shellshock vulnerability cannot be detected at webservers in advance?

There are lots of posts regarding the shellshock vulnerability. I can understand the vulnerability in detail. However, I'm curious about why any Intrusion detection system or host-based tools (e.g., ...