New answers tagged intrusion-detection
Check out Mugsy. You can monitor specific directories, but exclude certain patterns. It logs locally as well as to elasticsearch.
I think you've misread the manual...You'll notice that the instructions contain different steps for different operating systems. You are performing the steps in the box marked "Red Hat 6" and the steps in the box marked "Ubuntu". You should only be performing one OR the other.
You will find that hackers/scanners are also reducing their brute force attempts to even just a single attempt every day (again to avoid detection). If you wanted to tighten your security you could reduce the max intrusions to 1, and expand the interval to 2 days or more. (That is why the attack shown in your logs likely stops at 2 attempts). Based on ...
The attacker at 220.127.116.11 is spacing out his connection attempts to avoid detection. Be sure you set the maxintrusioninterval high enough to see multiple attempts, and maxintrusions set low enough to trigger the detection in that interval. Can you post your settings from the [credentials] stanza of secast.conf ? (or email the entire config file to ...
I believe in this case it should sniff traffic on br0. However, if its rules don't care about source addresses and you don't want to block or alert to potential outbound intrusions (and why not?) you can most likely sniff on the WAN interface without harm. Sniffing is passive, more or less, and just allows you to inspect everything going over an interface. ...
Top 50 recent answers are included