Intrusion Detection Systems

[Duke5A]

Anyone here have a functioning IDS setup, or experience you'd be willing to share? I honestly haven't touched this stuff since college, but thought it worth looking into now that things are finally settling down. We really don't have any cash to plunk down on any additional equipment now so I was looking at Snort and OSSEC. Can't seem to decide between Windows or Linux either. I'm no stranger to a Linux CLI (I setup a couple Squid proxies internally here), but already have a few devices running Windows I wanted to utilize. Any thoughts? Thanks guys..

[pete]

We use OSSEC (Host-based IDS and log shipping) and have done for a while. It's useful and has highlighted things that we would have otherwise missed in the logs. We monitor Linux, Windows & OS X clients using a Linux OSSEC server.

 

It's quite noisy by default, you'll want to set up a couple of guinea pig client servers and run the OSSEC client on them for a couple of weeks so you've an idea of the S/N ratio. Then tune it for things you care about, then add another server.

 

On a webserver (for example) it'll tell you about 404s, 503s and alert you beyond a certain rate limit (some herbert running automated scanning for phpmyadmin, for example). It'll also give you the option to respond (Active Response) if criteria you specify are met.

 

You can feed OSSEC into the free version of Splunk, the new (beta) version of the OSSEC Webui is a great improvement and/or you could use Analogi. There's another that I'm forgetting too.

 

Free tip:

 

Rule 102001: Stop DC Logon Spam

 

By default, the first time a user logs onto a host, Ossec is configured to send an email, even though it's only a Level* 3 alert (low). In certain circumstances (webserver or fileserver with limited number of authorised users) this is useful. In others (1100 users, 500 hosts, 3 DCs) it's not.

 

This rule is set to override the email alert if it receives rule 18119 from a domain controller.

 18119
 DC1.IP.ADD.RESS|DC2.IP.ADD.RESS|DC3.IP.ADD.RESS
 no_email_alert
 First time this user logged in this system -- no email

 

*Levels go from 0 > 15. Level 10 is where OSSEC will (by default) start emailling you.

 

0>3 = Successful auth, misc status notifications etc.

4>9 = Not much to worry about - bad configs, IIS exploit attempted on an Apache server, wrong password etc.

10 = I am going to start emailing you - i.e multiple failed logins

12 = Error or warning messages from the system/application.

13 = As above, but unusual - i.e strange URL request, buffer overflow attempt.

14 = High importance security event - OSSEC thinks you're being actively attacked.

15 = The attack was successful.

Edited October 1, 2013 by pete

[pete]

The guys at AlienVault have a working OSSIM VM that includes OSSEC (with lots of other gubbins built in) for testing. (if you can't find something in their Web GUI, you haven't right-clicked enough)

 

OSSIM: Open Source SIEM & Open Threat Exchange Projects

 

On the above, don't turn on the vulnerability scan without changing the alerting defaults, there's a daft amount of outdated tests and too many false positives.

[Duke5A]

@pete: You've given some really good pointers here. I've got a growing list of people I need to buy beer for if I ever get out to that side of the world. Thanks again!