Photo by Stoochi Lam on Unsplash
Centralized monitoring and intrusion detection
Alarm System
Ensuring the security of a company's IT infrastructure becomes increasingly important as new threats and forms of attack continually emerge. Linux already has numerous tools for detecting anomalies in networks across platforms that evaluate logfiles, among other tasks. However, many of the security tools that make life easier for administrators are scattered across the Internet and not easy to find.
The Security Onion [1] project addressed this shortcoming back in 2008. Originally based on Ubuntu, the security suite, which now runs in Docker environments, bundles professional tools for monitoring the IT infrastructure, including logfile analysis and intrusion detection [2]. The various ways of using the system include cloud images, which are intended for use in the Amazon, Google, and Azure clouds, and a downloadable ISO image that you can install on a dedicated host and deploy in virtual environments such as VirtualBox or VMware.
Strategies
When collecting, aggregating, and analyzing data, Security Onion can take both a host-based and network-based approach. The suite uses three tools for host-based intrusion detection: (1) Wazuh [3] is a fork of the OSSEC [4] intrusion detection system; it monitors hosts and sends data to a server in the event of anomalies. A cross-platform agent is installed on the computers for this purpose. By analyzing the log data, Security Onion detects malware and identifies further vulnerabilities that need to be addressed. (2) Osquery [5] is another host-based tool that queries and logs the system status. (3) Beats [6] uses Winlogbeat to
...
Buy this article as PDF
(incl. VAT)
Buy ADMIN Magazine
US / Canada
UK / Australia
Related content
-
Security analysis with Security Onion
Security Onion offers a comprehensive security suite for intrusion detection that involves surprisingly little work. - Suricata Intrusion Detection System Fixes Bugs
-
Detecting security threats with Apache Spot
Security vulnerabilities often remain unknown when the data they reveal is buried in the depths of logfiles. Apache Spot uses big data and machine learning technologies to sniff out known and unknown IT security threats. -
Discovering indicators of compromise
Open source pen testing tools help you view an attack from the perspective of both the attacker and the defender. -
Intrusion Detection with OSSEC
The OSSEC free intrusion detection and host-based intrusion prevention system detects and fixes security problems in real time at the operating system level with functions such as log analysis, file integrity checks, Windows registry monitoring, and rootkit detection. It can be deployed virtually anywhere and supports the Linux, Windows, and macOS platforms.