4 ms·

Does anyone know of a good snort alternative? Any recommendations for a company that runs mainly off AWS?

• iamtheworstdev 4y ago
  AWS network firewall loaded with suricata rules?
  • hnjst 4y ago
    I've been exploring this exact possibility a few days ago. The support for Suricata's rules in AWS Firewall is pretty limited though (https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-limitations-caveats.html https://docs.aws.amazon.com/network-firewall/latest/develope...).
• PenguinCoder 4y ago
  AWS is a totally different beast and you'll have other useful tools in the stack there. Cloud trail, guard duty, VPCs, proper least privilege and IAM rules, etc. What are you looking for in a snort alternative? It is the open source standard; though you might also look at suricata. Perhaps a whole security stack like security onion which incorporates snort and a lot of other tools. Might be overkill for what you want though.
  • nonane 4y ago
    > Cloud trail, guard duty, VPCs, proper least privilege and IAM rules We use all these. I guess this could be considered IDS + IPS?
    • PenguinCoder 4y ago
      I wouldn't put that level of logging as the same as an IDS/IPS, just alternatives.
    • spydum 4y ago
      Not IPS, those tools don't block access.
• annoyingnoob 4y ago
  Not sure about the AWS bit but I like Suricata.
• yabones 4y ago
  I've set up Suricata (similar to snort in many ways) on AWS, and it was a pretty horrible process. Basically what you need to do is set up VPC-Mirroring on every single interface in that VPC and send all the traffic to an endpoint attached to your snort server. https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-tra... It's a ton of work, and is quite expensive, since you're paying per interface + per traffic. A better way to handle it (imo) is to just enable VPC flow logging and pull the cloudwatch stream into your SIEM. Suricata/snort isn't that useful for threat detection anymore (thanks to HTTPS), so the important data to capture is just firewall logs. You can still have suricata/snort, but you have to be more selective with it.
  • nonane 4y ago
    > A better way to handle it (imo) is to just enable VPC flow logging and pull the cloudwatch stream into your SIEM Thank you. Any recommendations for SEIM for a small company?
    • spydum 4y ago
      check out managed instances like azure sentinel
    • Forbo 4y ago
      I'd say just spin up a SecurityOnion stack. It's essentially a "SOC-in-a-box". I had a proof of concept machine spun up and generating alerts off of replayed PCAPs in a day.
• slt2021 4y ago
  check this https://aws.amazon.com/marketplace/pp/prodview-mn63yjbq37n4c https://aws.amazon.com/marketplace/pp/prodview-mn63yjbq37n4c it is expensive, but for large company with good infosec budget it is worth every penny