Intrusion Detection Systems (IDS)
Snort
It is a free and open source IDS/IPS used to perform network traffic analysis, content matching to detect and prevent various attacks based on predefined rules.
Operational Modes
Snort has 3 main operational modes
1. Packet Sniffing
Collects and displays network traffic like wireshark does
2. Packet Logging
Collects and Logs network traffic in a file
3. Network Intrusion Detection
Analyze packets and matches traffic against signatures
Snort Rules
They are similar to typical firewall rules, they are used to detect network traffic against specific patterns or signatures and consequently make a decision whether to send an alert or drop the traffic (in IPS case). There are 3 types of snort rules
1. Community Rules
Free rules created by snort community
2. Registered Rules
Free rules created by Talos. Registered account is required to use them.
3. Subscription Only Rules
They require an active paid subscription in order to be accessed and used
Snort Rule Syntax
Automated Rule Generator (Snorpy)
Snorpy (http://www.cyb3rs3c.net/) can be used to generate rules easily for snorp
Snort IDS Network Placement
Snort Versions
1. Snort 2.X
De facto version of snort which means that is typically deployed and most widely implemented and has the most rules
2. Snort 3.0
Latest version that has improved efficiency, performance, scalability and usability over Snort 2.X
Suricata
It is also free and open source threat detection engine. It combines IDS, IPS and network security monitoring
Operational Modes
Active (IPS)
Passive (IDS)
Working
Exactly similar to how snort works
Integrating Wazuh with Suricata for Log Processing
Install Wazuh Agent on Suricata Server and edit the configuration file on both agent machine and wazuh dashboard to include /var/log/suricata/eve.json file Reference
Last updated
