Tag Info

New answers tagged

1

To put this a little more officially as an answer, I believe OSSEC has the options you're looking for. You can create custom rules, configure it to watch specific log files (such as your web server logs), and trigger alarms if certain regex matches or strings are detected. Active response can actually run more or less any command, you just have to place it ...


0

Googling I came upon this page titled: Snortsam - A Firewall Blocking Agent for Snort which is a plugin for Snort. According to this plugins page it can integrate with Sagan as well: excerpt SnortSam has also been integrated with Sagan, which is a log analysis engine developed by Champ Clark. The Snortsam Output Plugin and related files (header, ...


3

What you're seeing is automated probing for security holes in your website. Currently, attacks that try to retrieve the contents of wp-config.php are the big thing; other popular targets are phpMyAdmin and php-cgi. For probes like these, either you're vulnerable (and have probably already been successfully attacked) or you're not vulnerable (and have ...


7

Passively listening to network traffic to detecting suspicious behavior is still important. There are only a few obvious attacks which you might detect and block immediately but there is lots of traffic which only looks a bit suspicious or even innocent. But, if you collect traffic information over some time and maybe from multiple places in your network, ...


3

Do they still sell IDS? I think most vendors these days have an Intrusion Prevention device. This device can be configured to work in 'IDS' or 'IPS' mode. In fact you can even be as specific as saying for a particular set of signatures just detect, do not prevent. You would do this for signatures that are known to throw a lot of false positives. And for some ...


5

I would say that the main reason that most organizations would opt for an IDS over an IPS (assuming they do) is the fact that a false positive on an IDS is much less detrimental than an IPS' false positive. If an IPS incorrectly takes action against legitimate traffic it thinks is malicious then it's really doing more harm than good.


1

With Snort you can compile your rules as "shared objects" that use C instead of the Snort language and can be obfuscated. See #2 here: http://blog.snort.org/2011/02/snort-shared-object-rules.html


1

You should look into OWASP's App Sensor project; it is doing exactly the type of things you are talking about. Its more a proof of concept / example implementation, but the idea works and has a lot of merit. The project is focused on defining detection points and potential actions; they feel that each site should setup the rules between the two. We all ...



Top 50 recent answers are included