Page 1 of 1

Suricata intrusion detection and prevention engine

Posted: Mon 09 Apr 2012, 01:01
by scsijon
came across a pointer to this

http://www.openinfosecfoundation.org/in ... d-suricata
Suricata

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field.

OISF is part of and funded by the Department of Homeland Security's Directorate for Science and Technology HOST program (Homeland Open Security Technology), by the the Navy's Space and Naval Warfare Systems Command (SPAWAR), as well as through the very generous support of the members of the OISF Consortium. More information about the Consortium is available, as well as a list of our current Consortium Members.

The Suricata Engine and the HTP Library are available to use under the GPLv2.

The HTP Library is an HTTP normalizer and parser written by Ivan Ristic of Mod Security fame for the OISF. This integrates and provides very advanced processing of HTTP streams for Suricata. The HTP library is required by the engine, but may also be used independently in a range of applications and tools.

Suricata Stable is available here. The current version is 1.2.1, released January 20, 2012.

Linux/Mac/FreeBSD/UNIX/Windows Source:
http://www.openinfosecfoundation.org/do ... 2.1.tar.gz (2 MB)
may be of interest to someone.

regards

Posted: Mon 09 Apr 2012, 04:52
by Bligh
thanks for the post, it will be interesting to see what comes of it.
Cheers

Posted: Mon 09 Apr 2012, 05:43
by nooby
Thanks!

Would they really give this away for free unless it allowed them
to inspect every computer that installed it? Am I too pessimistic
and paranoid maybe? How can one download and boot this up
without them knowing the MAC address of the machine booting?

The best would be to make a FOSS version of it that has no backdoor
and no phone home in it?

Posted: Wed 18 Apr 2012, 15:18
by Barkin
Brian’s surname must be a pain in the backside ...
- Improved HTTP CONNECT support in libhtp (#427, Brian Rectanus -- Qualys)
https://www.openinfosecfoundation.org/