Tag Info

New answers tagged

0

For intrusion detection you will definitely want to monitor your access.log and error.log files for this web app. I would look out for: Unusually high traffic. Figure out what a normal amount of traffic is based on your access.log and set a monitor to alert you if you suddenly get a much greater amount (e.g. 10 times more requests) that could indicate ...


5

No, it is not possible. The hypervisor controls everything your VM does. The isolation between your VM and other people's VMs relies on the hypervisor. If the hypervisor maps the memory of your VM for its own use, or if it allows other VMs to map it, your VM won't know about it, because of the same isolation mechanisms that don't allow other VMs to access ...


0

Ok Break your Question with its solution into parts. PortScan There are some configurations that you need to change to enable nmap portscan open the snort configuration file with sudo gedit /etc/snort/snort.conf. uncomment and modify this line ( #428 usually ) : Portscan detection. For more information, see README.sfportscan preprocessor sfportscan: ...



Top 50 recent answers are included