Collaborate Disseminate
I can capture using YAF and SiLK nmap (TCP) on my IP, however, I am unable to capture any UDP “flow.”
Isn’t YAF and SiLK suppose to be able to at least assign the first UDP packet as part of a flow? Is there a specific para… Continue reading YAF and SiLK fail to capture UDP flow
A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where “virus” includes trojans, rootkits, et al.)
This does not help when defending against zero-days and active intrusions. By defi… Continue reading What do you call an antivirus that detects suspicious activity?
As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? Do the NIDS and HIDS are… Continue reading Combine SNORT detection and log with active response OSSEC
I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic.
Setup I am thinking about:
Snort computer with two NICs
One NIC connected to hub/tap outside firewall (WAN)
One NIC connected to hub/tap insi… Continue reading Can dual NIC Snort machine cause threats to bypass firewall?
I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privilege user has at that time) by looking at th… Continue reading Making sense of OSSEC logs
I signed up for UpWork.com so I can do some freelance web development. They have an option where you can verify you are a US citizen so you can apply for jobs that people asked for US workers only. They ask for one of the fol… Continue reading UpWork.com Identity Verification
I would require a security person to monitor my logs and traffic whether there are no data leaks or hidden malware being used. I have considered snort and suricata for ids but I don’t have the time neither the expertise to mo… Continue reading person based vs software based computer security
Emsisoft announced that internet security has been removed from their product lineup and they stick with Windows firewall and “fortify” that (“blocks illegitimate manipulations of Windows Firewall rules”).
Are there any need… Continue reading Intrusion detection in home security suites
Recently I participated in a capture the flag competition which was attached with SOC analysis teams monitoring our traffic.
There we were told that many tools were very noisy. Eg Sqlmap which has its full header.
As all of… Continue reading Reduce Noise when Penetration Testing