Tag Info

Hot answers tagged

4

The Bad News Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together. The Good News Fear not, we can make it work. ...


4

The world is your oyster with this one. If you simply need to create one alert use a packet crafting tool like scapy. Testing a rule like this in snort is easy, however, this can work for all types of rules. alert tcp any any -> any 80 (content:"GET";) From here, just fire up scapy and at the console type: ...


3

I'm not aware of any official product similar to EICAR but I'd suggest that something noisy and easily noticeable as invalid, such as a Christmas tree scan should achieve what you're looking for. An IDS if configured to notice/block port scans should definitely notice something like that which uses a packet type which should never (AFAIK) be valid ...


1

If you're worried about security you could use the naxsi module with nginx and catch such attempts a bit more explicitely with rules. I'm pretty happy with it - it's fast and lightweight. https://github.com/nbs-system/naxsi


1

I would look at Snort signatures, learn how they are written and use them as a template if you need to create your own. For some examples, this page has collected several signatures it has found most effective against malware found by its Honeypot. This is a good article about testing Snort with Metasploit. Since you asked about a book, it has been almost ...


1

If it's that much of a secure environment you should never disable your IDS. Besides, if your IDS picks up your vulnerability scanner - Thats good as you know your IDS is working and not been tampared with. I'd recommend something like: 1. Add your IP (which you'll be doing your scan from) to a whitelist so you're excluded from your rules then do your ...


1

On a) most IDS' allow the option of blocking addresses from generating alerts which answers your b). I believe the approach you are taking is a decent approach however, I need chime in that it is BEST to perform dual scanning. From the OUTSIDE of your perimeter, and from the inside. The reasoning is simple, external scanning usually finds nothing more than ...


1

You've got a number of options. The first and most common is to instruct the IDS to ignore attacks originating at the vulnerability scanner, and to configure the vulnerability scanner to correspond to the IDS. The second solution, which requires a lot more work, but has a lot more value is to take this as an opportunity to validate the behavior of both ...



Only top voted, non community-wiki answers of a minimum length are eligible