Tag Info

Hot answers tagged

5

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription. Firewalls serve to control the inbound/outbound connections into an ...


1

It depends on your reqirement, where you are going to use your or snort IDPS. It means, If your DMZ or network is getting attacked more frequently then you should go for Emerging Threat Pro rules because it will be updated every day so you will get protected by new attacks or might be zero day. In the other hand snort VRT paid version rules will be updated ...


1

To put this a little more officially as an answer, I believe OSSEC has the options you're looking for. You can create custom rules, configure it to watch specific log files (such as your web server logs), and trigger alarms if certain regex matches or strings are detected. Active response can actually run more or less any command, you just have to place it ...



Only top voted, non community-wiki answers of a minimum length are eligible