As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? Do the NIDS and HIDS are stand-alone system that cannot be integrated each other ?
The assumption is like below:
- I Implemented both NIDS and HIDS in my server
- NIDS for SNORT and HIDS for Ossec.
- After, that let's say there are anomaly that could be found in network layer(i.e DDoS )
- That's look like a job for NIDS (SNORT)
- It should be triggered the SNORT rules.
- SNORT Analyzed the anomaly, collected the information, and do some action that we assign in SNORT rules.
- SNORT do some action for the anomaly that have been found.
- After that, the information that SNORT collected will be send to Ossec.
- If the attacker ( the anomaly ) can pass SNORT rules, there is a backup that handle the anomaly, and it was OSSEC
Is this possible ? or this is not a good idea ?
My motive by doing this is, i want to make a several security that located in Network and Host-based, so it make my Data center/server more safe than using one type of IDS