Hot answers tagged ids
The layout/format is usually determined by the con and specified in the CFP if not web based. As to the content of your CFP response i found this post to be very helpful when I started: https://www.defcon.org/html/links/dc-speakerscorner.html#nikita-cfp
No, Snort is not designed to log all application and events occurring in a system. A HIDS is not just a NIDS limited to just one host; it's a separate and additional layer of protections that can only be performed locally (like looking at files, processes, logs, and user contexts). Snort doesn't even try to do any of that.
Trying to detect malicious URLs is a difficult and in many ways impossible game to win, just like trying to detect malware in executables. IF you are trying to protect your network from malicious URLs, there are threat feeds available, which are useful, be as others have stated, domains are cheap and easy to throw away. The strongest way to prevent ...
Domain names are cheap. Attackers are quite happy to register a domain to use in a single campaign. At some point thereafter the domain will be red-flagged by reputation services, but by that time the attacker has moved onto the next one.
Only top voted, non community-wiki answers of a minimum length are eligible