Re: EDR
Gil ANDRE via slackware <[email protected]> Sat, 29 Oct 2022 01:34:40 +0200
| Newsgroups | gmane.linux.slackware |
|---|---|
| Message-ID | <[email protected]> |
--===============2123587248953308114== Content-Type: multipart/alternative; boundary=----MLRDGBH0OMJUF6J5Q1XM8IYALTADME Content-Transfer-Encoding: 7bit ------MLRDGBH0OMJUF6J5Q1XM8IYALTADME Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Most of these EDR solutions are for Red Hat or Debian only=2E Dark Trace se= lls appliances only, including virtual appliances, which may - or may not -= work under Slackware=2E As far as I can tell, most "Enterprise" EDR solutions are not open source= =2E Depending on your needs, you may be able to approximate an EDR solution us= ing open source software under Slackware=2E A combination of ClamAV, OSSEC = or Samhain, Zeek or suricata will cover 90% of an EDR perimeter, and these = are all open source solutions that can run under Slackware=2E The real issue here is the time and budget needed to integrate all these s= olutions=2E On October 27, 2022 3:12:55 PM GMT+02:00, Thomas Altfather Good <thomasalt= fathergood@gmail=2Ecom> wrote: >Hi, thanks much=2E > >Do any of the EDRs install relatively easily with Slackware? > > > >-- > >Thomas Altfather Good >thomasgood=2Ecom > > >Washington-Baltimore News Guild, CWA Local 32035 >National Press Photographers Association > >Level 6, Google Guide: google=2Ethomasgood=2Ecom > > >=E2=80=9ELeben Sie jetzt die Fragen=2E=E2=80=9C -- Rainer Maria Rilke > > > > >On Thu, Oct 27, 2022, 08:57 Gil ANDRE <andre=2Eg@wanadoo=2Efr> wrote: > >> OSSEC works very well on Slackware, I have been using it for a long tim= e=2E >> >> Wazuh is also very good, is a fork of OSSEC, but it requires a lot more >> work, since it drags a whole ELK stack=2E >> >> Both are not EDR, though, you should look at things like Dark Trace, >> Tehtris or Harfang Labs if you really want an EDR=2E >> >> On October 27, 2022 2:13:45 PM GMT+02:00, Thomas Altfather Good via >> slackware <slackware@mailman=2Elug=2Eorg=2Euk> wrote: >>> >>> Thanks Gabriel, this is very helpful=2E >>> >>> Cheers >>> >>> -- >>> >>> Thomas Altfather Good >>> thomasgood=2Ecom >>> >>> >>> Washington-Baltimore News Guild, CWA Local 32035 >>> National Press Photographers Association >>> >>> Level 6, Google Guide: google=2Ethomasgood=2Ecom >>> >>> >>> =E2=80=9ELeben Sie jetzt die Fragen=2E=E2=80=9C -- Rainer Maria Rilke >>> >>> >>> >>> >>> On Thu, Oct 27, 2022, 08:02 Gabriel D=C3=ADaz L=C3=B3pez de la Llave v= ia slackware < >>> slackware@mailman=2Elug=2Eorg=2Euk> wrote: >>> >>>> hello >>>> >>>> Wazuh is open source and can be integrated with many environments=2E = It >>>> does not support Slackware natively, but I=E2=80=99m sure it can be a= dapted=2E >>>> >>>> https://github=2Ecom/wazuh/wazuh >>>> >>>> There is a very active slack community where you can interact with ot= her >>>> people using it=2E >>>> >>>> https://wazuh=2Ecom/community/join-us-on-slack/ >>>> >>>> gabriel >>>> >>>> >>>> >>>> El 27 oct 2022, a las 13:54, Thomas Altfather Good via slackware < >>>> slackware@mailman=2Elug=2Eorg=2Euk> escribi=C3=B3: >>>> >>>> >>>> Hi All, >>>> >>>> Has anyone gotten SentinelOne to work with Slackware? >>>> >>>> Or - can someone recommend an EDR? >>>> >>>> Thanks! >>>> -- >>>> >>>> Thomas Altfather Good >>>> thomasgood=2Ecom >>>> >>>> >>>> Washington-Baltimore News Guild, CWA Local 32035 >>>> National Press Photographers Association >>>> >>>> Level 6, Google Guide: google=2Ethomasgood=2Ecom >>>> >>>> >>>> =E2=80=9ELeben Sie jetzt die Fragen=2E=E2=80=9C -- Rainer Maria Rilke >>>> >>>> >>>> >>>> -- >>>> slackware mailing list >>>> slackware@mailman=2Elug=2Eorg=2Euk >>>> https://mailman=2Elug=2Eorg=2Euk/mailman/listinfo/slackware >>>> >>>> >>>> -- >>>> slackware mailing list >>>> slackware@mailman=2Elug=2Eorg=2Euk >>>> https://mailman=2Elug=2Eorg=2Euk/mailman/listinfo/slackware >>>> >>> -- >> Sent from my Android device with K-9 Mail=2E Please excuse my brevity= =2E >> --=20 Sent from my Android device with K-9 Mail=2E Please excuse my brevity=2E ------MLRDGBH0OMJUF6J5Q1XM8IYALTADME Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head></head><body>Most of these EDR solutions are for Red Hat or Deb= ian only=2E Dark Trace sells appliances only, including virtual appliances,= which may - or may not - work under Slackware=2E<br><br>As far as I can te= ll, most "Enterprise" EDR solutions are not open source=2E<br><br>Depending= on your needs, you may be able to approximate an EDR solution using open s= ource software under Slackware=2E A combination of ClamAV, OSSEC or Samhain= , Zeek or suricata will cover 90% of an EDR perimeter, and these are all op= en source solutions that can run under Slackware=2E<br><br>The real issue h= ere is the time and budget needed to integrate all these solutions=2E<br><b= r><div class=3D"gmail_quote">On October 27, 2022 3:12:55 PM GMT+02:00, Thom= as Altfather Good <thomasaltfathergood@gmail=2Ecom> wrote:<blockquote= class=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0=2E8ex; border-left: 1= px solid rgb(204, 204, 204); padding-left: 1ex;"> <div dir=3D"auto">Hi, thanks much=2E<div dir=3D"auto"><br></div><div dir= =3D"auto">Do any of the EDRs install relatively easily with Slackware?<br><= div dir=3D"auto"><br></div><div dir=3D"auto"><br><br><div data-smartmail=3D= "gmail_signature" dir=3D"auto">--<br><br>Thomas Altfather Good<br><a href= =3D"http://thomasgood=2Ecom">thomasgood=2Ecom</a><br><br><br>Washington-Bal= timore News Guild, CWA Local 32035<br>National Press Photographers Associat= ion<br><br>Level 6, Google Guide: <a href=3D"http://google=2Ethomasgoo= d=2Ecom">google=2Ethomasgood=2Ecom</a><br><br><br>=E2=80=9ELeben Sie jetzt = die Fragen=2E=E2=80=9C -- Rainer Maria Rilke<br><br><br> &n= bsp; </div></div></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr= " class=3D"gmail_attr">On Thu, Oct 27, 2022, 08:57 Gil ANDRE <<a href=3D= "mailto:andre=2Eg@wanadoo=2Efr">andre=2Eg@wanadoo=2Efr</a>> wrote:<br></= div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 =2E8ex;border-l= eft:1px #ccc solid;padding-left:1ex"><div>OSSEC works very well on Slackwar= e, I have been using it for a long time=2E<br><br>Wazuh is also very good, = is a fork of OSSEC, but it requires a lot more work, since it drags a whole= ELK stack=2E<br><br>Both are not EDR, though, you should look at things li= ke Dark Trace, Tehtris or Harfang Labs if you really want an EDR=2E<br><br>= <div class=3D"gmail_quote">On October 27, 2022 2:13:45 PM GMT+02:00, Thomas= Altfather Good via slackware <<a href=3D"mailto:slackware@mailman=2Elug= =2Eorg=2Euk" target=3D"_blank" rel=3D"noreferrer">slackware@mailman=2Elug= =2Eorg=2Euk</a>> wrote:<blockquote class=3D"gmail_quote" style=3D"margin= :0pt 0pt 0pt 0=2E8ex;border-left:1px solid rgb(204,204,204);padding-left:1e= x"> <div dir=3D"auto">Thanks Gabriel, this is very helpful=2E<div dir=3D"auto"= ><br></div><div dir=3D"auto">Cheers<br><br><div data-smartmail=3D"gmail_sig= nature" dir=3D"auto">--<br><br>Thomas Altfather Good<br><a href=3D"http://t= homasgood=2Ecom" target=3D"_blank" rel=3D"noreferrer">thomasgood=2Ecom</a><= br><br><br>Washington-Baltimore News Guild, CWA Local 32035<br>National Pre= ss Photographers Association<br><br>Level 6, Google Guide: <a href=3D"= http://google=2Ethomasgood=2Ecom" target=3D"_blank" rel=3D"noreferrer">goog= le=2Ethomasgood=2Ecom</a><br><br><br>=E2=80=9ELeben Sie jetzt die Fragen=2E= =E2=80=9C -- Rainer Maria Rilke<br><br><br> </div></= div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_at= tr">On Thu, Oct 27, 2022, 08:02 Gabriel D=C3=ADaz L=C3=B3pez de la Llave vi= a slackware <<a href=3D"mailto:slackware@mailman=2Elug=2Eorg=2Euk" targe= t=3D"_blank" rel=3D"noreferrer">slackware@mailman=2Elug=2Eorg=2Euk</a>> = wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 =2E= 8ex;border-left:1px #ccc solid;padding-left:1ex"><div style=3D"line-break:a= fter-white-space">hello<div><br></div><div>Wazuh is open source and can be = integrated with many environments=2E It does not support Slackware natively= , but I=E2=80=99m sure it can be adapted=2E </div><div><br></div><div>= <a href=3D"https://github=2Ecom/wazuh/wazuh" rel=3D"noreferrer noreferrer" = target=3D"_blank">https://github=2Ecom/wazuh/wazuh</a></div><div><br></div>= <div>There is a very active slack community where you can interact with oth= er people using it=2E </div><div><br></div><div><a href=3D"https://waz= uh=2Ecom/community/join-us-on-slack/" rel=3D"noreferrer noreferrer" target= =3D"_blank">https://wazuh=2Ecom/community/join-us-on-slack/</a><br></div><d= iv></div><div><br></div><div>gabriel</div><div><br></div><div><br><div><br>= <blockquote type=3D"cite"><div>El 27 oct 2022, a las 13:54, Thomas Altfathe= r Good via slackware <<a href=3D"mailto:slackware@mailman=2Elug=2Eorg=2E= uk" rel=3D"noreferrer noreferrer" target=3D"_blank">slackware@mailman=2Elug= =2Eorg=2Euk</a>> escribi=C3=B3:</div><br><div><div dir=3D"auto"><br>Hi A= ll, <div dir=3D"auto"><br></div><div dir=3D"auto">Has anyone gotten Se= ntinelOne to work with Slackware?</div><div dir=3D"auto"><br></div><div dir= =3D"auto">Or - can someone recommend an EDR?</div><div dir=3D"auto"><br></d= iv><div dir=3D"auto">Thanks!<br><div data-smartmail=3D"gmail_signature" dir= =3D"auto">--<br><br>Thomas Altfather Good<br><a href=3D"http://thomasgood= =2Ecom/" rel=3D"noreferrer noreferrer" target=3D"_blank">thomasgood=2Ecom</= a><br><br><br>Washington-Baltimore News Guild, CWA Local 32035<br>National = Press Photographers Association<br><br>Level 6, Google Guide: <a href= =3D"http://google=2Ethomasgood=2Ecom/" rel=3D"noreferrer noreferrer" target= =3D"_blank">google=2Ethomasgood=2Ecom</a><br><br><br>=E2=80=9ELeben Sie jet= zt die Fragen=2E=E2=80=9C -- Rainer Maria Rilke<br><br><br>  = ; </div></div></div> -- <br>slackware mailing list<br><a href=3D"mailto:slackware@mailman=2Elug= =2Eorg=2Euk" rel=3D"noreferrer noreferrer" target=3D"_blank">slackware@mail= man=2Elug=2Eorg=2Euk</a><br><a href=3D"https://mailman=2Elug=2Eorg=2Euk/mai= lman/listinfo/slackware" rel=3D"noreferrer noreferrer" target=3D"_blank">ht= tps://mailman=2Elug=2Eorg=2Euk/mailman/listinfo/slackware</a><br></div></bl= ockquote></div><br></div></div>-- <br> slackware mailing list<br> <a href=3D"mailto:slackware@mailman=2Elug=2Eorg=2Euk" rel=3D"noreferrer no= referrer" target=3D"_blank">slackware@mailman=2Elug=2Eorg=2Euk</a><br> <a href=3D"https://mailman=2Elug=2Eorg=2Euk/mailman/listinfo/slackware" re= l=3D"noreferrer noreferrer noreferrer" target=3D"_blank">https://mailman=2E= lug=2Eorg=2Euk/mailman/listinfo/slackware</a><br> </blockquote></div> </blockquote></div><div style=3D"white-space:pre-wrap"><div>-- <br>Sent fr= om my Android device with K-9 Mail=2E Please excuse my brevity=2E</div></di= v></div></blockquote></div> </blockquote></div><div style=3D'white-space: pre-wrap'><div class=3D'k9ma= il-signature'>-- <br>Sent from my Android device with K-9 Mail=2E Please ex= cuse my brevity=2E</div></div></body></html> ------MLRDGBH0OMJUF6J5Q1XM8IYALTADME-- --===============2123587248953308114== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- slackware mailing list [email protected] https://mailman.lug.org.uk/mailman/listinfo/slackware --===============2123587248953308114==--