Suricata intrusion detection and prevention engine

For discussions about security.
Post Reply
Message
Author
scsijon
Posts: 1596
Joined: Thu 24 May 2007, 03:59
Location: the australian mallee
Contact:

Suricata intrusion detection and prevention engine

#1 Post by scsijon »

came across a pointer to this

http://www.openinfosecfoundation.org/in ... d-suricata
Suricata

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field.

OISF is part of and funded by the Department of Homeland Security's Directorate for Science and Technology HOST program (Homeland Open Security Technology), by the the Navy's Space and Naval Warfare Systems Command (SPAWAR), as well as through the very generous support of the members of the OISF Consortium. More information about the Consortium is available, as well as a list of our current Consortium Members.

The Suricata Engine and the HTP Library are available to use under the GPLv2.

The HTP Library is an HTTP normalizer and parser written by Ivan Ristic of Mod Security fame for the OISF. This integrates and provides very advanced processing of HTTP streams for Suricata. The HTP library is required by the engine, but may also be used independently in a range of applications and tools.

Suricata Stable is available here. The current version is 1.2.1, released January 20, 2012.

Linux/Mac/FreeBSD/UNIX/Windows Source:
http://www.openinfosecfoundation.org/do ... 2.1.tar.gz (2 MB)
may be of interest to someone.

regards

Bligh
Posts: 480
Joined: Sun 08 Jan 2006, 11:05
Location: California

#2 Post by Bligh »

thanks for the post, it will be interesting to see what comes of it.
Cheers

nooby
Posts: 10369
Joined: Sun 29 Jun 2008, 19:05
Location: SwedenEurope

#3 Post by nooby »

Thanks!

Would they really give this away for free unless it allowed them
to inspect every computer that installed it? Am I too pessimistic
and paranoid maybe? How can one download and boot this up
without them knowing the MAC address of the machine booting?

The best would be to make a FOSS version of it that has no backdoor
and no phone home in it?
I use Google Search on Puppy Forum
not an ideal solution though

User avatar
Barkin
Posts: 803
Joined: Fri 12 Aug 2011, 04:55

#4 Post by Barkin »

Brian’s surname must be a pain in the backside ...
- Improved HTTP CONNECT support in libhtp (#427, Brian Rectanus -- Qualys)
https://www.openinfosecfoundation.org/

Post Reply