3 ms·
> Everyone uses it. I hear this phrase about many software platforms. That's why I'd like to see some numbers before someone uses an absolute qualifier. I have
by hdjjhhvvhga 4y ago
> Everyone uses it.
I hear this phrase about many software platforms. That's why I'd like to see some numbers before someone uses an absolute qualifier. I have no idea how popular is Zeek against OSSEC, Suricata or Snort these days, I'm just wary of claiming something without providing any justification.
- tptacek 4y agoI think the real issue here is that things like Snort, Suricata, and Zeek are just not very popular as a class of security thingy anymore. Certainly, for the last 10 years or so, I'd have advised most startups I worked with against deploying anything like them. There was, in the long-long-ago, a huge industry debate about whether detection and response was best done in the network or on the endpoint. That debate has been settled: most places deploy EDR, and few places deploy IPS.
- nemo44x 4y agoThe DoD would beg to differ. EDR is a huge business indeed but often network monitoring is used in conjunction. Also startups make up almost nothing of the ecosystem. Fortune 1000 and Gov have millions of different departments that have their own requirements.