3 ms·
Is this equal to OSSEC, an Open Source Host-based Intrusion Detection System? http://www.ossec.net/ http://www.ossec.net/
by SunboX 13y ago
Is this equal to OSSEC, an Open Source Host-based Intrusion Detection System? http://www.ossec.net/ http://www.ossec.net/
- jvehent 13y agoNo. MozDef analyzes logs and events that are shipped to its data pipeline by servers and applications.
- cones688 13y agoThat's an IDS, a specific security measure, akin to firewalls, AV, IPS, Vuln Scanners. MozDef seems to be trying to make a relevant/niche ticketing system to run over the top of a SIEM (Security Information and Event Manager) which in turn runs over the top of IDS/IPS/AV/FW etc etc this allows single view and correlation between events i.e remote login from contracter over VPN using chinese IP address, escalating privileges on a unix box, new admin account on DB, increase in data flow outbound from DB, none of these events is individually significant but together its pretty obvious something might be wrong, thats why you pay good money for a SIEM. The issue most companies face is they have awesome security intelligence platforms or SIEMS but then have to translate it into awful business process ticketing systems (like Remedy or Jira) not designed to handle such critical and quick moving issues.