Collaborate Disseminate
Several different measures of effectiveness tell us incident response (IR) generally takes too long and costs too much. For example, a global study…
The post The Benefits, Characteristics and Components of Flyaway Kits for Incident Response appeared … Continue reading The Benefits, Characteristics and Components of Flyaway Kits for Incident Response
The aim is to detect, if anyone in the HOME_NET is searching for “terrorism” and generate an alert. I am using Snort 2.9 installed in a virtual machine (VirtualBox) running Ubuntu 18.04.
This same qs was asked here but rema… Continue reading How to create content rule in Snort
I understand UTM nowadays is difficult to truly define, in terms of feature set. Largely due to so many manufacturers tailoring them to accomplish various things. Some center around Malware detection, some include IPS functio… Continue reading UTM in place of IPS
I am new to snort and I am trying to make a rule that will detect repeating bits in a packet. I set it to offset to the 100th bit and the depth is 105 bits. The problem I am having is I can’t figure out how to make it detect … Continue reading Detect repeating bits with snort
I currently understand the deployment factors considered when using IDS for a business, but I’m wondering what factors should I consider when making a decision on the IDS deployment in a home network?
How does a large corporation such as SpaceX or Samsung secure their information?
Do they use the same enterprise hardware that a small to mid-size company has access to? I imagine it’s mostly down to employee training.
I do… Continue reading How does a large corporation manage information security?
I’m very proud to announce the release of PolarProxy today! PolarProxy is a transparent TLS proxy that decrypts and re-encrypts TLS traffic while also generating a PCAP file containing the decrypted traffic. PolarProxy enables you to do lots of things … Continue reading PolarProxy Released
In snort I can easely get packet length attribute (pkt_len) related to an alert. However in Suricata I don’t see these information in JSON alerts (from eve.json). How can I get these information?
Continue reading How can I get Packet length from Suricata output?
Is brute force login detection feasible with netflow data?
With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a service-specific (SSH, FTP etc.) thres… Continue reading Centralized brute force login detection using netflow data
From whatever I have read of Snort, it can analyse a single packet at a time and raise an alert based on its rules.
What if I wish to have a rule based on multiple packets such as analysis of a protocol situation that can m… Continue reading Stateful detection in Snort