Collaborate Disseminate
How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I’ve seen so many papers that discuss the same, but how do they come up with these num… Continue reading Confusion Matrix for Generated Signatures in Snort
I currently have a setup with OSSEC and AIDE running on our servers.
We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log.
I want to make an exception for that, but I still want to … Continue reading How do I create exceptions on Wazuh (OSSEC)?
I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look at the event and determin… Continue reading How do use ArcSight ESM to monitor powershell logs? [on hold]
I’m prototyping the use of FIM software and just installed OSSEC manager. I want to add a client but when I do I get the following agent menu:
sudo /var/ossec/bin/manage_agents
****************************************
* … Continue reading Why would an OSSEC manager act as if it is an agent? [on hold]
This question is similar with this one:
OSSEC capabilities for handle a virus that already spread into the deepest system
But it didnt roughly answer how could i do that exactly. I have tried Wazuh app for maybe 5 months in… Continue reading Does Wazuh have capabilities for handle virus ? If yes, How?
Being fairly new to both AIDE and OSSEC I’ve been trying to find out if there are any potential conflicts in having them both installed on one host (CentOS 7.5). It seems like they could work as a multi-layered approach, but … Continue reading AIDE and OSSEC conflicts?
Let’s say you have a large environment of several thousand servers. You have the manager and agents configured.
I understand that you have an OSSEC.conf file and also a rules file.
Does the agent have a copy of the OSSEC co… Continue reading OSSEC configuration
I have an older OSSEC deployment that has their old WUI running. However, it’s quite outdated and I’m looking to use some of the newest features of later versions (Slack integration). I’m trying to find a current GUI to manag… Continue reading What current GUI options are available for OSSEC (possibly open source)?
I have problem with some institute server. The scenario is like below.
There is an institute (Government/Corporate/Industry) that have their own dedicated server. But there is no other security services or firewall that wer… Continue reading Can NIDS alone protect the Servers in our network, or we need HIDS application as well?
I got an assigntment from my lecturer about information security. So I made my own server using a VM and I installed a “HIDS” application. My lecturer asked:
“what method did you use on your security?”
i am bit confused bec… Continue reading Are the Intrusion Detection system for information security a methodology? [on hold]