Collaborate Disseminate
I would appreciate if you can shed some light on must-have security alerts and thresholds configured on an IPS. Also, is there any online repository with any guidelines to support the same?
Continue reading What are the must-have security alert configured on IPS devices?
Suppose an attacker attacks on webserver and our ids triggers an alert that we have SQL injection. What should we do now?
Shall we block that IP? What if attacker already modify some data? How we are going to know that?
I’m searching for anomaly-based network IDS software. I could be able to catch some open source tools like bro and hogzilla and lots of white papers. However, I couldn’t find a stable commercial tool. Is there any?
Continue reading Are there any commercial anomaly-based network IDS? [on hold]
What are the security risks of opening port 22 from a client within a company network to an external party, assuming that both IDS and DLP are implemented?
The intent is to remotely transfer data sensitive from the external… Continue reading Security risks of opening port 22
*I’ve subscribed and emailed the bro mailing list but have not received any replies. This is the exact same message.
Hello and thank you for your assistance. As the subject states, I’m not getting email notifications to this… Continue reading Need assistance setting up BRO (IDS) email alerts/notifications
As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus also scans the traffic and … Continue reading What is the difference between an anti-virus and an IPS?
I am running snort on Ubuntu 16.04 in AWS. I want to run snort in the inline mode. It was not dropping/blocking/rejecting traffic to the website on port 80. I need it to block such traffic. What am I doing wrong?
Monitor… Continue reading How do I get Snort to run in inline mode so it functions as an IPS?
I am running snort on Ubuntu 16.04 in AWS. I want to run snort in the inline mode. It was not dropping/blocking/rejecting traffic to the website on port 80. I need it to block such traffic. What am I doing wrong?
Monitor… Continue reading How do I get Snort to run in inline mode so it functions as an IPS?
I’m trying to write a rule to catch a Slow-Loris attack, this is what i have –
alert tcp any any -> any any (msg:”Possible Slow Loris attack”; classtype: denial-of-service; flow: to_server, established; pcre: !”/\x0D\x0A… Continue reading IDS Snort rule to catch Slow-Loris
I can capture using YAF and SiLK nmap (TCP) on my IP, however, I am unable to capture any UDP “flow.”
Isn’t YAF and SiLK suppose to be able to at least assign the first UDP packet as part of a flow? Is there a specific para… Continue reading YAF and SiLK fail to capture UDP flow