Collaborate Disseminate
I am testing snort against pytbull. I am using pulledpork rules and snort 2.9.9.0. Tests do not detect LFI and all rule test. I have 31056 rules enabled (VRT (community, registered), ET) when I am searching for rules that wil… Continue reading Do registered snort rules contain all rules that match attack or do we need to add others?
I am running Snort as IDS in Security Onion and get this message: 0 Dynamic rules
All SO_RULES are loaded in snort.conf in the correct path.
25867 Snort rules read
23950 detection rules
150 decoder rules
268 p… Continue reading 0 dynamic rules read
I am using suricata with emerging-scan.rules and other rules. The rules are loaded in the suricata.yaml, homenet and ext_net are configured correctly.
For testing detection of suricata I used nmap -sS in the machine in which suricata is i… Continue reading Suricata: nmap scan does not match rules
I can’t find information about the frequency of signature updates for Snort. I mean the free version (not Sourcefire NGIPS). Does anybody know it?
Continue reading What is the frequency of signature updates for Snort (free version)? [on hold]
I want to know if unexpected utilization of RAM/CPU etc can cause false positives in IDS.
Continue reading Can CPU, RAM etc utilization information cause false positives in an IDS? [on hold]
I am using suricata 4.0.4 with default rules; emerging threat. I want to add other sources for better detection. What are the sources that I can use to manually download the rules?
Continue reading what are the source of log that can suricata use [on hold]
I am using snort 3 with all snort 3 community rules against pytbull ids. But snort does not detect attack, and also the signature was not matched. How can I perform snort 3 ++ rules for better detection of attack?
pytbull is… Continue reading How can I perform snort 3 signature?
What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both management and sniffing and… Continue reading Benefit of using two network interfaces for intrusion detection system
I am using pytbull for evaluation of snort IDS. When I run the command ./pytbull -t adressIpOfSnort –offline
I get
ERROR :FTP Error ,530 Login incorrect Also check privileges on remote host.
For the config.cfg I have:
… Continue reading FTP error when testing pytbull against snort [on hold]
Thinking about the recent news regarding SOHO routers vulnerable to the VPNFilter attack: https://arstechnica.com/information-technology/2018/05/fbi-tells-router-users-to-reboot-now-to-kill-malware-infecting-500k-devices/ .
… Continue reading Could an IPS have blocked an attack on a vulnerable router/firewall?