Re: Can Zeek be installed as in-line IPS?

Yes, exactly. We need to be careful with our messaging on this as a
community because the number of threats still seen (and more generally, the
amount of metadata from traffic that can be successfully logged to support
NSM) is still significant. Richard said "fairly dead" but casual readers
and the tech press tend to take that as a soundbyte and parrot it out as
"it's basically all encrypted, don't worry about it." I have had customers
that have refuse an option to deploy a network sensor like Zeek or Suricata
in their environment in the role of NSM sensors because of this erroneous
belief (and a convenient chance to save some capex not buying more
hardware). It's disappointing because we see a lot of success detecting
badness in other environments so these customers willfully put themselves
at a disadvantage to attackers who still operate over cleartext protocols.

- Darren

On Mon, Mar 18, 2019 at 8:46 AM Patrick Kelley <
[email protected]> wrote:

> Had me all the way until...
>
> "Aside from web application firewalls, I think the IPS market is fairly
> dead anyway with the ubiquity of encrypted north-south network traffic.".
>
> I still see the same issues we had on networks 10 years ago. It is
> reduced, due to HTTPS and some SMTP, sure.  Dead... not really.
>
> On Mon, Mar 18, 2019 at 11:19 AM Richard Bejtlich <[email protected]>
> wrote:
>
>> JB's answer was great. I'd only add that I don't think of Zeek as an IDS.
>> Zeek is a network security monitor. It's designed to describe what's
>> happening on your network in a mostly neutral way. It's up to the analyst
>> to use that data for a variety of purposes, one of which could be intrusion
>> detection. Suricata and Snort are more characteristic of an "IDS" because
>> they make judgements about what they see, although Suricata has been
>> integrating ever more NSM functionality by logging DNS, HTTP, etc. as Zeek
>> does.
>>
>> Aside from web application firewalls, I think the IPS market is fairly
>> dead anyway with the ubiquity of encrypted north-south network traffic.
>>
>> Sincerely,
>>
>> Richard
>>
>> On Mon, Mar 18, 2019 at 6:04 AM Dario Mohaddes <[email protected]>
>> wrote:
>>
>>> I'm starting a comparison paper about inline Network IPS. I was looking
>>> for an opensource anomaly-based detection engine with IPS capabilities. The
>>> easiest choice seemed Zeek but from the website user-manual it doesn't look
>>> like it actually supports packets dropping, instead can only work as IDS.
>>> Digging a bit online I found a lot of confusion and contradictions with
>>> people asserting either that is possible or not but none giving a practical
>>> example. I have scraped a multitude of academic and research papers but
>>> they haven’t help... I was wondering if anyone can tell me if is feasible
>>> before wasting hours trying to do something that is not. Any help or
>>> insight is much appreciated. Thank you.
>>> _______________________________________________
>>> Zeek mailing list
>>> [email protected]
>>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>>
>>
>>
>> --
>> Richard Bejtlich
>> Principal Security Strategist, Corelight
>> _______________________________________________
>> Zeek mailing list
>> [email protected]
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>
>
>
> --
>
> *Patrick Kelley, CISSP, C|EH, ITIL*
> *CTO*
> [email protected]
> (o) 770-224-6482
>
> *The limit to which you have accepted being comfortable is the limit to
> which you have grown. Accept new challenges as an opportunity to enrich
> yourself and not as a point of potential failure.*
>
>
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek



-- 
Darren Spruell
[email protected]

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek