I have some web server logs from a breach. Is there a tool in SecurityOnion where I can upload the log files in csv format and have some sort of behavior-driven, static IDS/IPS identify when a breach occurred?

  • For SecurityOnion you could just feed it the logs as a file. Doesn't SecurityOnion already have a bunch of rules for SQLi, XSS and other malicious activity detection? – Raimonds Liepiņš Aug 31 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.