owlhnet 🦉

Open source to easily Visualize and Manage #Suricata_ids and #Zeek at scale.

[owlhnet 🦉 @owlhnet]

Hellowlh!!! does it look cool? #suricata_IDS #elasticsearch #Kibana

[owlhnet 🦉 @owlhnet]

Hellowlh!!!! Try OwlH now and find how it can help you.
https://t.co/OGvZTBA1Vy

[owlhnet 🦉 @owlhnet]

@NetwarSystem Hey, did you get an answer here?

[Suricata IDS/IPS @Suricata_IDS]

#Suricata 4.1 is out with default Rust support, adding SMB, DHCP, TLS 1.3 and many more protocol additions and improvements.

Some other additions: compressed pcap logging, community flow id, new compact DNS EVE format, filestore v2.

Check: https://t.co/gyaO8FODhf #ids #ips

[Santiago Bassett @santiagobassett]

Threat detection and incident response with @elastic and @wazuh https://t.co/ravvuv1rr5 #cybersecurity #threatintelligence

[Jose 🅰 Izquierdo 🦉 @jizquierdolopez]

A few words about the Buffered Traffic Capture process that may be useful. Just enjoy it and ask if you want to play with it. @owlhnet #bufferedtrafficcapture #networkids #nhids https://t.co/OK131LZpGT

[owlhnet 🦉 @owlhnet]

Better than traffic capture after an incident, start recording traffic before incident happens. @OwlHnet #Buffered #Traffic #Capture (#BTC)
- Select targets to monitor
- Define buffer to store pre-incident traffic
- Specify Incident Indicator Trigger
- Pre and Post capture

[owlhnet 🦉 @owlhnet]

@wazuh and @owlhnet - NHIDS implementation
- Network IDS traffic analysis and alert
➕
- Using eBPF at host for
-> #OwlH - Host Traffic Capture and related service details
-> #Wazuh - Host IDS alerts with process detail
⬇️⬇️
- Network IDS Alert enrichment with Process details

[owlhnet 🦉 @owlhnet]

Trace TCP traffic in an instance and find what process (PID and name) is using it by using #eBPF, #BCC tools. The tool is modified to export in json format to simplify management. Will be really useful to enrich #Suricata_IDS and #Bro_IDS alerts. To be continued

[Santiago Bassett @santiagobassett]

#Wazuh 3.2.4 has just been released. A comprehensive security monitoring platform based on #OSSEC, #OpenSCAP and #Elasticsearch. Great for intrusion detection, compliance and incident response. Completely free open source. More info at https://t.co/pc4pl6GyZy

[Jose 🅰 Izquierdo 🦉 @jizquierdolopez]

After a bit of improvement and research, Software TAP implementation for #GCLOUD and #AWS using #suricata_ids and #bro_ids. @OwlHnet https://t.co/0aA09G4GWI

[owlhnet 🦉 @owlhnet]

Another @owlhnet 🦉 step: Integrating #Bro_IDS in @wazuh: 👉 1.-#Bro_IDS events output to JSON and event enrichment 👉 2.- Secure transport by @wazuh 👉 3.- @owlhnet #Bro_IDS rules for @wazuh 👉 4.- JSON tuning for @wazuh index on #ELK. Et voilà https://t.co/8YA0Rk3Q1J

[owlhnet 🦉 @owlhnet]

job done! Using #suricata_ids to analyze traffic from multiple #AWS based instances and integrate detected alerts in @wazuh. Capture traffic with #tcpdump as software TAP #vTAP and use #ansible helping with process orchestration #NIDS_Management https://t.co/oWQLC4FrwA

[Alfon 🎸 Seguridad y Redes @seguridadyredes]

#OwlH. Unified #IDS Management.

An open source tool to easily Visualize and Manage #Suricata_IDS and #BroIDS at scale. Big-Data, Incident Response.., Dashboards, Cloud Network IDS support and on-demand capture ...
https://t.co/HWRt3AiVfe
(Promete y mucho. Seguimiento, si o si.)

[Jose 🅰 Izquierdo 🦉 @jizquierdolopez]

Great @wazuh 2018 kick-off. Thanks, guys for such amazing time this week. Impressive team building a great product for the big security market. And thanks for letting me introduce you the @owlhnet project. #hids #nids_management

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Over 1 TB of #PCAP files from the @wrccdc #CDX have been released online thanks to @spiceywasabi and @disturbedmime. The WRCCDC dataset is now linked from our PCAP repository list.
https://t.co/rAvYVoDQct

[owlhnet 🦉 @owlhnet]

@yashar6909 @wazuh Thanks for your feedback @yashar6909, We are in PoC mode right now. So, if you want to play just say hellowl!. check our https://t.co/TleKlHUMad site too.

[owlhnet 🦉 @owlhnet]

Hellowl world! 🦉 helping to integrate #suricata_ids in @wazuh. Provides #NIDS alerts and #PCI-DSS v3.2 mapping. Supporting #AWS and on-premises environments. https://t.co/WfXVQKaiLR. #nids_management