4

I wan to run a cron job on each of my hosts that sends a list of all open ports to a central db on which I will run auditing and forensic queries.

My question is how often should this job run so I could consider this coverage reliable. Obviously running it to often could potentially acquire too much resources from the host.

I hope my question makes sense. If it doesn't then what's the alternative.

5
  • OSSEC does exactly same thing what you, and much more of course. As far as I know, it executes commands with 2 second frequency by default. Commented Nov 4, 2015 at 21:31
  • 1
    What kind of hosts? What do you mean by "reliable"? What does this detective control hope to achieve?
    – schroeder
    Commented Nov 4, 2015 at 21:49
  • linux hosts. Reliable means that most likely(>99.9%) that an unauthorized connection will be logged.
    – Ezra
    Commented Nov 4, 2015 at 21:54
  • @Mehmet can you link to a documentation that says OSSEC executes every 2 seconds? that would be awesome, I couldn't find one.
    – Ezra
    Commented Nov 4, 2015 at 21:56
  • 1
    @Ezra Yes it was out of documentation. I've read some source code for you. Please look at line between 107-110 github.com/ossec/ossec-hids/blob/… Commented Nov 5, 2015 at 11:52

1 Answer 1

6

This will depend solely on your threat model.

In some environments, weekly may be fine, especially combined with something like Tripwire alerting.

For other, more dynamic or higher risk environments, you may wish to look at running it every half hour, or even more frequently, such as Mehmet's comment about running every 2 seconds (although in my opinion the network load at that frequency would be much more trouble than it is worth unless you have a very small network!)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .