Questions tagged [hids]

Questions about Host Based Intrusion Detection Systems

0
votes
0answers
42 views

How can I get Packet length from Suricata output?

In snort I can easely get packet length attribute (pkt_len) related to an alert. However in Suricata I don't see these information in JSON alerts (from eve.json). How can I get these information?
2
votes
1answer
28 views

Confusion Matrix for Generated Signatures in Snort

How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I've seen so many papers that discuss the same, but how do ...
1
vote
0answers
31 views

How do I create exceptions on Wazuh (OSSEC)?

I currently have a setup with OSSEC and AIDE running on our servers. We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log. I want to make an exception for ...
1
vote
0answers
160 views

How do use ArcSight ESM to monitor powershell logs? [closed]

I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look ...
0
votes
1answer
401 views

Does Wazuh have capabilities for handle virus/malware/rootkit ? If yes, How?

This question is similar with this one: OSSEC capabilities for handle a virus that already spread into the deepest system But it didnt roughly answer how could i do that exactly. I have tried Wazuh ...
1
vote
1answer
556 views

AIDE and OSSEC conflicts?

Being fairly new to both AIDE and OSSEC I've been trying to find out if there are any potential conflicts in having them both installed on one host (CentOS 7.5). It seems like they could work as a ...
0
votes
2answers
176 views

Can NIDS alone protect the Servers in our network, or we need HIDS application as well?

I have problem with some institute server. The scenario is like below. There is an institute (Government/Corporate/Industry) that have their own dedicated server. But there is no other security ...
0
votes
1answer
660 views

Combine SNORT detection and log with active response OSSEC

As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? ...
1
vote
0answers
168 views

Identifying privilege escalation in OSSEC logs [closed]

I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privileges a user has at ...
2
votes
2answers
281 views

Can OSSEC detect buffer overflow attacks?

I am trying to detect buffer overflow by using OSSEC (a HIDS software) as mentioned in OSSEC rules example and OSSEC book. How can I configure OSSEC for detect a simple buffer overflow example as the ...
1
vote
1answer
123 views

Escaping Virtualbox type intrusion detection?

Is there a way to run intrusion detection for if anything tries to escape from Virtualbox? Thank you.
1
vote
0answers
86 views

Is HID attack via UART (RS-232) possible?

I see there is a recent question about intrusion via USB here. Would it be similar to do an HID attack via the serial port (UART / RS-232)? Are there known examples? I can easily physically conduct ...
9
votes
2answers
8k views

HIDS - Choosing between regular OSSEC or Wazuh fork

I intend to set up OSSEC and noticed there seem to be two main flavours: plain OSSEC and Wazuh fork. From what I've been able to gather (from Wazuh's website and documentation), the main advantages ...
2
votes
1answer
982 views

Tap-mode IPS vs IDS

It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks. In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
3
votes
1answer
937 views

Silence OSSEC rootcheck alerts

I'm trying to silence some OSSEC rootcheck alerts like these:- ** Alert 1456448991.70239: mail - ossec,rootcheck, 2016 Feb 26 01:09:51 myhost->rootcheck Rule: 519 (level 7) -> 'System Audit: ...
0
votes
1answer
532 views

Do I need ossec for my personal home computer? [closed]

Do I really need a HIDS like ossec, or will using good passwords, using a firewall, an antivirus/antimalware program, and a rootkit scanner do the job well enough?
-1
votes
1answer
85 views

Host Based IDS with syscall monitoring

Hey Guys I am a newbie in security stuff and now I am working on my final project about host based IDS. I have some questions to you guys Can a rootkit be classified as an intrusion or is it a ...
2
votes
0answers
1k views

USB Rubber Ducky Firmware Upgrade [closed]

I just erased my firmware, using dfu-programmer-0.7.2: $ dfu-programmer at32uc3b1256 erase Checking memory from 0x2000 to 0x3FFFF... Not blank at 0x2001. Erasing flash... Success Checking memory from ...
1
vote
0answers
415 views

How to test OSSEC HIDS using a linux dataset containing raw system call traces?

I have been tasked to test effectiveness of OSSEC HIDS (by effectiveness I mean detection rate it achieves as well as false positives rate) when a dataset of raw system call traces are used. The ...
2
votes
1answer
2k views

Can Snort be configured as HIDS?

I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS. I want to know is there any way I can configure Snort as an HIDS? If I am ...
6
votes
3answers
621 views

Which Windows Files Should be Monitored by HIDS?

I highlighted my question below. Here is some background. It's easy to find data showing the most commonly trojaned/modified Linux binaries and config files. ps, ls, find, kill, lsof, passwd, shadow,...