Re: Can Zeek be installed as in-line IPS?
"Seth Hall" <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
On 18 Mar 2019, at 11:30, Patrick Kelley wrote: > I still see the same issues we had on networks 10 years ago. It is > reduced, due to HTTPS and some SMTP, sure. Dead... not really. To be fair, he did say IPS. In my opinion IPS has always been in a weird spot where the definition isn't terribly clear (block a single packet in-flight? block a connection after a determination is made? ...etc). I think everyone here will agree that the visibility provided by Zeek is useful even on modern networks and that tail of completely unencrypted traffic is awfully long. :) .Seth -- Seth Hall * Corelight, Inc * www.corelight.com _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek