Re: Can Zeek be installed as in-line IPS?
Joe Blow <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
Take a look at the netcontrol stuff. https://docs.zeek.org/en/latest/frameworks/netcontrol.html Zeek will talk to other systems to perform the actual action of crushing the connection. Best hope with that scenario really is that you kill the connection a few packets in, as you're racing to block on an inline device (router, switch, FW), from another passive system (Zeek). It blurs the line between IDS and IPS because the race condition. Good example is droppers. You might only have subsecond to block. Are you really running an IPS if some packets can get through? Reactive IDS might be a more apt analogy. Cheers, JB Sent via the BlackBerry Hub for Android From: [email protected] Sent: March 18, 2019 6:04 AM To: [email protected] Subject: [Zeek] Can Zeek be installed as in-line IPS? I'm starting a comparison paper about inline Network IPS. I was looking for an opensource anomaly-based detection engine with IPS capabilities. The easiest choice seemed Zeek but from the website user-manual it doesn't look like it actually supports packets dropping, instead can only work as IDS. Digging a bit online I found a lot of confusion and contradictions with people asserting either that is possible or not but none giving a practical example. I have scraped a multitude of academic and research papers but they haven’t help... I was wondering if anyone can tell me if is feasible before wasting hours trying to do something that is not. Any help or insight is much appreciated. Thank you. _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek