Open Source IDS and Logging - Generation 2 Suricata And Central Syslog Appliance (Reality Check Series Book 7) by Tony Miedaner

Open Source IDS and Logging - Generation 2 Suricata And Central Syslog Appliance (Reality Check Series Book 7) by Tony Miedaner

Author:Tony Miedaner [Miedaner, Tony]
Language: eng
Format: epub
Published: 2018-07-25T23:00:00+00:00


Promiscuous mode

/etc/rc3.d/S110promscuous

Signature feed

We use the ThreatExpert feed; the script to do this is included in Appendix A, Suricata-downloads.sh.

IP reputation

We use multiple sources for our bad IP feed, see Appendix A, iprep-listsv0.sh .

Local rules

Sample local rules are in Appendix A (local.rules).

Monitoring

We monitor the system for the Suricata and sec services. See Appendix A for start-Suricata.sh script information.

Simple Event Correlator

Startup.

Start using systemd.

Rules

Since rules should be customized we only provide a sample in Appendix A, Sec Rule Sample.

Monitoring

See start-sec.sh in Appendix A. This file is run in the cron periodically for monitoring.

syslog-ng

syslog-ng.conf

syslog-ng.conf is show in Appendix A.



Download



Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.