2

I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS. I want to know is there any way I can configure Snort as an HIDS? If I am updating variable HOME_NET to my IP, it'll log all ingress and egress traffic but is there a way to make it log all application and events occurring in a system?

Thank you in advance.

Improve this question
1

1 Answer 1

Reset to default
4

No, Snort is not designed to log all application and events occurring in a system. A HIDS is not just a NIDS limited to just one host; it's a separate and additional layer of protections that can only be performed locally (like looking at files, processes, logs, and user contexts). Snort doesn't even try to do any of that.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .