New answers tagged ids
The layout/format is usually determined by the con and specified in the CFP if not web based. As to the content of your CFP response i found this post to be very helpful when I started: https://www.defcon.org/html/links/dc-speakerscorner.html#nikita-cfp
No, Snort is not designed to log all application and events occurring in a system. A HIDS is not just a NIDS limited to just one host; it's a separate and additional layer of protections that can only be performed locally (like looking at files, processes, logs, and user contexts). Snort doesn't even try to do any of that.
Trying to detect malicious URLs is a difficult and in many ways impossible game to win, just like trying to detect malware in executables. IF you are trying to protect your network from malicious URLs, there are threat feeds available, which are useful, be as others have stated, domains are cheap and easy to throw away. The strongest way to prevent ...
Domain names are cheap. Attackers are quite happy to register a domain to use in a single campaign. At some point thereafter the domain will be red-flagged by reputation services, but by that time the attacker has moved onto the next one.
For intrusion detection you will definitely want to monitor your access.log and error.log files for this web app. I would look out for: Unusually high traffic. Figure out what a normal amount of traffic is based on your access.log and set a monitor to alert you if you suddenly get a much greater amount (e.g. 10 times more requests) that could indicate ...
Full documentation on the latest version of OSSEC is here: http://ossec-docs.readthedocs.org/en/latest/index.html The documentation is a little light and I found I had to do a lot of trial and error to get it to do exactly what I wanted. My recommendation, especially if you're new to the software, would be to download the Server Virtual Appliance here: ...
Top 50 recent answers are included