Tag Info

New answers tagged

0

Firewall, IDS and IPS are not the same creatures. And as stated, defense in depth is the thing you're looking to provide. A Firewall is a control mechanism used to restrict the protocols traversing between two networks at layers 3 and 4 - that is its primary function (See Shane's answer). In some instances, the firewall can perform limited inspection of ...


5

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription. Firewalls serve to control the inbound/outbound connections into an ...


0

Defense in depth Presumably, your firewall will be letting some traffic in and out. Otherwise, just disconnect from the network and you'll have a lot less to worry about. Once traffic comes in to your network past the firewall, it would be prudent to be keeping an eye on it to make sure it isn't malicious. Unless your firewall rules are perfect, you are ...


0

This is not an attack The IDS is merely telling you that you have an SSL certificate with a weak algorithm. more info The IP address is the address of your own internal server, that has the weak certificate.


1

It depends on your reqirement, where you are going to use your or snort IDPS. It means, If your DMZ or network is getting attacked more frequently then you should go for Emerging Threat Pro rules because it will be updated every day so you will get protected by new attacks or might be zero day. In the other hand snort VRT paid version rules will be updated ...


1

To put this a little more officially as an answer, I believe OSSEC has the options you're looking for. You can create custom rules, configure it to watch specific log files (such as your web server logs), and trigger alarms if certain regex matches or strings are detected. Active response can actually run more or less any command, you just have to place it ...


0

Googling I came upon this page titled: Snortsam - A Firewall Blocking Agent for Snort which is a plugin for Snort. According to this plugins page it can integrate with Sagan as well: excerpt SnortSam has also been integrated with Sagan, which is a log analysis engine developed by Champ Clark. The Snortsam Output Plugin and related files (header, ...



Top 50 recent answers are included