-1

I'm thinking of using Suricata or Snort. I can't do anything myself, so I'm going to ask a freelance security engineer to do it.

If the engineer is skilled, once suricata or snort is set up, will it work fine in one setup? at the moment,there is no problem with only detecting the IP of unauthorized access by hacker.

Also, I know that security engineers have their own areas of expertise, but what skills do good suricata or snort engineers often have?

Improve this question
5
  • 1
    "once suricata or snort is set up, will it work fine in one setup?" - No. An IDS/IPS has significant maintenance costs: it will generate alarms which can point to a problem or be a false positive - so one needs expertise to understand these and react to these. Rules need to be adjusted to what is running in the network, emerging threats need new rules for detection ...
    – Steffen Ullrich
    May 26 at 5:03
  • I see. So there's a maintenance fee.Which is better if I want to specialize in IDS? If it's set up right, will it detect better than business AV?
    – john-trmb
    May 26 at 9:58
  • 1
    "If it's set up right, will it detect better than business AV? " - Network IDS like snort and suricata and AV are different kind of products for different kind of problems. They make sense when combined, not when one is used instead of the other.
    – Steffen Ullrich
    May 26 at 13:05
  • What types of problems can each of those three solve? If those have to combine all three to function properly as an IDS, that's sad.
    – john-trmb
    May 27 at 0:52
  • Please use a search engine to get more insights into this topic. This is not something which can be answered in a short comment, but there are many articles online about it.
    – Steffen Ullrich
    May 27 at 2:41

0

Reset to default

Browse other questions tagged .