3 ms·
The thing with Snort (and others like it like Suricata) is that they produce a lot of false positives. You end up with a process of constant tuning of the filte
by annoyingnoob 4y ago
The thing with Snort (and others like it like Suricata) is that they produce a lot of false positives. You end up with a process of constant tuning of the filters and the filters update/change over time so that process never ends.
Maybe its not as noisy in a smaller/home environment but you'll still be going through the alerts.
Then when you do get an alert that looks interesting it might take you a lot of time to understand what it means and if it is real or matches the pattern for some other reason.
While you may learn things, and you can block things Snort finds to prevent issues before they happen, you'll have some work to do. Some are up for that work and some are not.
I've had IDS systems show me things I did not know about. I've never had one save my bacon. IDS is one of those 'part of this complete breakfast' things that doesn't stand alone well but needs to be part of a security solution/approach.