I wan to run a cron job on each of my hosts that sends a list of all open ports to a central db on which I will run auditing and forensic queries.

My question is how often should this job run so I could consider this coverage reliable. Obviously running it to often could potentially acquire too much resources from the host.

I hope my question makes sense. If it doesn't then what's the alternative.

  • OSSEC does exactly same thing what you, and much more of course. As far as I know, it executes commands with 2 second frequency by default. Nov 4 '15 at 21:31
  • 1
    What kind of hosts? What do you mean by "reliable"? What does this detective control hope to achieve?
    – schroeder
    Nov 4 '15 at 21:49
  • linux hosts. Reliable means that most likely(>99.9%) that an unauthorized connection will be logged.
    – Ezra
    Nov 4 '15 at 21:54
  • @Mehmet can you link to a documentation that says OSSEC executes every 2 seconds? that would be awesome, I couldn't find one.
    – Ezra
    Nov 4 '15 at 21:56
  • 1
    @Ezra Yes it was out of documentation. I've read some source code for you. Please look at line between 107-110 github.com/ossec/ossec-hids/blob/… Nov 5 '15 at 11:52

This will depend solely on your threat model.

In some environments, weekly may be fine, especially combined with something like Tripwire alerting.

For other, more dynamic or higher risk environments, you may wish to look at running it every half hour, or even more frequently, such as Mehmet's comment about running every 2 seconds (although in my opinion the network load at that frequency would be much more trouble than it is worth unless you have a very small network!)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.