Collaborate Disseminate
I have a FortiWeb appliance and I have the following algorithm:
IF THREAT_LEVEL == ‘CRITICAL’ THEN
$STORED_BANNED_SRC_IP = $SRC_IP
banned_IP($SRC_IP)
AND after 30 minutes I want to unbanned $src_ip
UNBANNDED_IP($STORED_BANNED_S… Continue reading Implementation banned IP in FortiWeb [closed]
I’ve got Snort compiled, configured, and running. Only problem I have is that it fails when I try to run it as a service. I’ve mainly been using the guide from here: https://snort-org-site.s3.amazonaws.com/production/document_files/files/0… Continue reading Snort fails when run as a service
I have a web server with each web application running as it’s own machine level account.
The server only hosts the web applications, no other services, dbs, etc.
Apart from the web server processes, nothing else should execute as these acc… Continue reading Would monitoring for unusual process execution help identify intrusions on a web server?
I want to write a rule for Snort to detect lost traffic in the network. Is it possible to write a rule that, by combining two flags, SYN and ACK, it declares that if the number of SYNs to the server exceeds a certain number, but at the sam… Continue reading Is it possible to count SYN and ACK flags separately in a single rule in Snort?
Some repositories have a set of Snort rules that cover a wide range of possible attacks.
Is it reasonable to use this set of rules (with a large number of rules) for a network and does it not significantly reduce performance (In this way, … Continue reading What is the effect of the number of snort rules on performance? [closed]
Reading through Suricata/Snort IDS rules, I can see examples such as below, and scratching my head to understand how is it feasible that a connection from home_network to external_network can have a flow direction to_client? I thought:
ho… Continue reading Snort / Suricata rules from HOME_NET with rule option flow:to_client
It’s sometimes convenient to generate ids client-side in a typical CRUD app.
The main benefit is for optimistic updates: you can update your client state with the right id without waiting for the response.
Examples:
The id is used in some… Continue reading What security issues could occur when generating ids on the client?
The following is a list of personal email address accounts and XMPP account IDs known to belong to Maksim Viktorovich… Continue reading A List of Personally Identifiable Email Address Accounts and XMPP Account IDs on Maksim Viktorovich Yakubets (Aqua) and Members of EvilCorp’s Cybercrime Enterprise
I was signing up for Shop and Ship, and they asked me to upload my passport, driver’s license or my national ID, and the reason for that, as they say, is to clear customs. Is it safe to upload?
Image of the request: https://i.stack.imgur.c… Continue reading Shop and Ship is asking me for my ID card. Is it safe? [closed]
I’m thinking of using Suricata or Snort.
I can’t do anything myself, so I’m going to ask a freelance security engineer to do it.
If the engineer is skilled, once suricata or snort is set up, will it work fine in one setup?
at the moment,th… Continue reading What kind of engineers should I look for to implement Suricata or Snort?