Summary If you already run Suricata, you should not have to tear it down in order to manage it centrally. In this post I will explain why “rebuild it our way” is the wrong answer for a production IDS, and how IDSTower now onboards an existing Suricata installation instead — detecting what you already run, […]
Manage your existing Suricata installation without reinstalling it Read More »
Continuing with our previous posts describing why & how to alert on Indicators of Compromise with Suricata IDS using the Dataset feature, in this post, we will describe, how to alert on malicious files observed in the network. For that, we will use a list of Malware hashes obtained from abuse.ch ThreaFox API, But first,
Configuring Suricata IDS to alert on Malicious Files Hashes Read More »
Summary In this post, I will explain why you should utilize Suricata IDS to alert on Network-Based Indicators of Compromise (IOCs), what are the traditional approach and its limitations, How Suricata will differ & what advantages you will get. Introduction Traditionally, SOC Operators used network Indicators of Compromise (IOCs) (eg: domains, IP…etc.) to detect malicious
Why you should use Suricata IDS to alert on IOCs Read More »
