3 ms·
Is this intended to compliment or replace things like alienvault/snort? Can it handle raw nix logs? Logstash? Windows events? It seems like from the post some k
by obituary_latte 11y ago
Is this intended to compliment or replace things like alienvault/snort? Can it handle raw nix logs? Logstash? Windows events? It seems like from the post some kind of third party connection is required (LANDesk?), but I may not be reading right.
At any rate, thanks as always for sharing :)
- freehunter 11y agoIt doesn't seem like it replaces Snort, which is an intrusion prevention system. It's more akin to AlienVault, which is a SIEM. Netflix shies away from the term SIEM. They call this an incident response software. I'm reading through it trying to figure out how it's different from a SIEM, but there's not a lot of technical details.
- thieving_magpie 11y agoSo akin to snorby mixed with Ossec active-response? Should be interesting to see if this gets picked up in an OS like Security Onion. Also, it appears to use snort.