Re: EDR
Thomas Altfather Good via slackware <[email protected]> Sat, 29 Oct 2022 06:53:48 -0400
| Newsgroups | gmane.linux.slackware |
|---|---|
| Message-ID | <CAGoMKscd+Kw0sz_MO6RT6fGT8+7b_YigMuAKOnAcGc+OKSQP8g@mail.gmail.com> |
--===============4960930969818363499== Content-Type: multipart/alternative; boundary="0000000000008f358305ec2a3255" --0000000000008f358305ec2a3255 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Gil, One of my mates recommended AIDE, another: snort. What do you think? (I'm a database guy and our paid consultant is pushing Sentinel - he was not able to install it, not being a unix person, so I did it but now he can't configure it...so I'm trying to offer alternatives. I installed OSSEC and it works fine but he apparently doesn't like this...) On Fri, Oct 28, 2022 at 7:34 PM Gil ANDRE <[email protected]> wrote: > Most of these EDR solutions are for Red Hat or Debian only. Dark Trace > sells appliances only, including virtual appliances, which may - or may n= ot > - work under Slackware. > > As far as I can tell, most "Enterprise" EDR solutions are not open source= . > > Depending on your needs, you may be able to approximate an EDR solution > using open source software under Slackware. A combination of ClamAV, OSSE= C > or Samhain, Zeek or suricata will cover 90% of an EDR perimeter, and thes= e > are all open source solutions that can run under Slackware. > > The real issue here is the time and budget needed to integrate all these > solutions. > > On October 27, 2022 3:12:55 PM GMT+02:00, Thomas Altfather Good < > [email protected]> wrote: >> >> Hi, thanks much. >> >> Do any of the EDRs install relatively easily with Slackware? >> >> >> >> -- >> >> Thomas Altfather Good >> thomasgood.com >> >> >> Washington-Baltimore News Guild, CWA Local 32035 >> National Press Photographers Association >> >> Level 6, Google Guide: google.thomasgood.com >> >> >> =E2=80=9ELeben Sie jetzt die Fragen.=E2=80=9C -- Rainer Maria Rilke >> >> >> >> >> On Thu, Oct 27, 2022, 08:57 Gil ANDRE <[email protected]> wrote: >> >>> OSSEC works very well on Slackware, I have been using it for a long tim= e. >>> >>> Wazuh is also very good, is a fork of OSSEC, but it requires a lot more >>> work, since it drags a whole ELK stack. >>> >>> Both are not EDR, though, you should look at things like Dark Trace, >>> Tehtris or Harfang Labs if you really want an EDR. >>> >>> On October 27, 2022 2:13:45 PM GMT+02:00, Thomas Altfather Good via >>> slackware <[email protected]> wrote: >>>> >>>> Thanks Gabriel, this is very helpful. >>>> >>>> Cheers >>>> >>>> -- >>>> >>>> Thomas Altfather Good >>>> thomasgood.com >>>> >>>> >>>> Washington-Baltimore News Guild, CWA Local 32035 >>>> National Press Photographers Association >>>> >>>> Level 6, Google Guide: google.thomasgood.com >>>> >>>> >>>> =E2=80=9ELeben Sie jetzt die Fragen.=E2=80=9C -- Rainer Maria Rilke >>>> >>>> >>>> >>>> >>>> On Thu, Oct 27, 2022, 08:02 Gabriel D=C3=ADaz L=C3=B3pez de la Llave v= ia >>>> slackware <[email protected]> wrote: >>>> >>>>> hello >>>>> >>>>> Wazuh is open source and can be integrated with many environments. It >>>>> does not support Slackware natively, but I=E2=80=99m sure it can be a= dapted. >>>>> >>>>> https://github.com/wazuh/wazuh >>>>> >>>>> There is a very active slack community where you can interact with >>>>> other people using it. >>>>> >>>>> https://wazuh.com/community/join-us-on-slack/ >>>>> >>>>> gabriel >>>>> >>>>> >>>>> >>>>> El 27 oct 2022, a las 13:54, Thomas Altfather Good via slackware < >>>>> [email protected]> escribi=C3=B3: >>>>> >>>>> >>>>> Hi All, >>>>> >>>>> Has anyone gotten SentinelOne to work with Slackware? >>>>> >>>>> Or - can someone recommend an EDR? >>>>> >>>>> Thanks! >>>>> -- >>>>> >>>>> Thomas Altfather Good >>>>> thomasgood.com >>>>> >>>>> >>>>> Washington-Baltimore News Guild, CWA Local 32035 >>>>> National Press Photographers Association >>>>> >>>>> Level 6, Google Guide: google.thomasgood.com >>>>> >>>>> >>>>> =E2=80=9ELeben Sie jetzt die Fragen.=E2=80=9C -- Rainer Maria Rilke >>>>> >>>>> >>>>> >>>>> -- >>>>> slackware mailing list >>>>> [email protected] >>>>> https://mailman.lug.org.uk/mailman/listinfo/slackware >>>>> >>>>> >>>>> -- >>>>> slackware mailing list >>>>> [email protected] >>>>> https://mailman.lug.org.uk/mailman/listinfo/slackware >>>>> >>>> -- >>> Sent from my Android device with K-9 Mail. Please excuse my brevity. >>> >> -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. > --=20 Thomas Altfather Good thomasgood.com Washington-Baltimore News Guild, CWA Local 32035 National Press Photographers Association Level 6, Google Guide: google.thomasgood.com =E2=80=9ELeben Sie jetzt die Fragen.=E2=80=9C -- Rainer Maria Rilke --0000000000008f358305ec2a3255 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>Gil,</div><div><br></div><div>One of my mates recomme= nded AIDE, another: snort.</div><div><br></div><div>What do you think?</div= ><div><br></div><div>(I'm a database guy and our paid consultant is pus= hing Sentinel - he was not able to install it, not being a unix person, so = I did it but now he can't configure it...so I'm trying to offer alt= ernatives. I installed OSSEC and it works fine but he apparently doesn'= t like this...)<br></div></div><br><div class=3D"gmail_quote"><div dir=3D"l= tr" class=3D"gmail_attr">On Fri, Oct 28, 2022 at 7:34 PM Gil ANDRE <<a h= ref=3D"mailto:[email protected]">[email protected]</a>> wrote:<br></di= v><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;borde= r-left:1px solid rgb(204,204,204);padding-left:1ex"><div>Most of these EDR = solutions are for Red Hat or Debian only. Dark Trace sells appliances only,= including virtual appliances, which may - or may not - work under Slackwar= e.<br><br>As far as I can tell, most "Enterprise" EDR solutions a= re not open source.<br><br>Depending on your needs, you may be able to appr= oximate an EDR solution using open source software under Slackware. A combi= nation of ClamAV, OSSEC or Samhain, Zeek or suricata will cover 90% of an E= DR perimeter, and these are all open source solutions that can run under Sl= ackware.<br><br>The real issue here is the time and budget needed to integr= ate all these solutions.<br><br><div class=3D"gmail_quote">On October 27, 2= 022 3:12:55 PM GMT+02:00, Thomas Altfather Good <<a href=3D"mailto:thoma= [email protected]" target=3D"_blank">[email protected]</= a>> wrote:<blockquote class=3D"gmail_quote" style=3D"margin:0pt 0pt 0pt = 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div dir=3D"auto">Hi, thanks much.<div dir=3D"auto"><br></div><div dir=3D"a= uto">Do any of the EDRs install relatively easily with Slackware?<br><div d= ir=3D"auto"><br></div><div dir=3D"auto"><br><br><div dir=3D"auto">--<br><br= >Thomas Altfather Good<br><a href=3D"http://thomasgood.com" target=3D"_blan= k">thomasgood.com</a><br><br><br>Washington-Baltimore News Guild, CWA Local= 32035<br>National Press Photographers Association<br><br>Level 6, Google G= uide:=C2=A0<a href=3D"http://google.thomasgood.com" target=3D"_blank">googl= e.thomasgood.com</a><br><br><br>=E2=80=9ELeben Sie jetzt die Fragen.=E2=80= =9C=C2=A0-- Rainer Maria Rilke<br><br><br>=C2=A0=C2=A0=C2=A0 </div></div></= div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_at= tr">On Thu, Oct 27, 2022, 08:57 Gil ANDRE <<a href=3D"mailto:andre.g@wan= adoo.fr" target=3D"_blank">[email protected]</a>> wrote:<br></div><bloc= kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:= 1px solid rgb(204,204,204);padding-left:1ex"><div>OSSEC works very well on = Slackware, I have been using it for a long time.<br><br>Wazuh is also very = good, is a fork of OSSEC, but it requires a lot more work, since it drags a= whole ELK stack.<br><br>Both are not EDR, though, you should look at thing= s like Dark Trace, Tehtris or Harfang Labs if you really want an EDR.<br><b= r><div class=3D"gmail_quote">On October 27, 2022 2:13:45 PM GMT+02:00, Thom= as Altfather Good via slackware <<a href=3D"mailto:[email protected]= .org.uk" rel=3D"noreferrer" target=3D"_blank">[email protected]<= /a>> wrote:<blockquote class=3D"gmail_quote" style=3D"margin:0pt 0pt 0pt= 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div dir=3D"auto">Thanks Gabriel, this is very helpful.<div dir=3D"auto"><b= r></div><div dir=3D"auto">Cheers<br><br><div dir=3D"auto">--<br><br>Thomas = Altfather Good<br><a href=3D"http://thomasgood.com" rel=3D"noreferrer" targ= et=3D"_blank">thomasgood.com</a><br><br><br>Washington-Baltimore News Guild= , CWA Local 32035<br>National Press Photographers Association<br><br>Level = 6, Google Guide:=C2=A0<a href=3D"http://google.thomasgood.com" rel=3D"noref= errer" target=3D"_blank">google.thomasgood.com</a><br><br><br>=E2=80=9ELebe= n Sie jetzt die Fragen.=E2=80=9C=C2=A0-- Rainer Maria Rilke<br><br><br>=C2= =A0=C2=A0=C2=A0 </div></div></div><br><div class=3D"gmail_quote"><div dir= =3D"ltr" class=3D"gmail_attr">On Thu, Oct 27, 2022, 08:02 Gabriel D=C3=ADaz= L=C3=B3pez de la Llave via slackware <<a href=3D"mailto:slackware@mailm= an.lug.org.uk" rel=3D"noreferrer" target=3D"_blank">[email protected]= rg.uk</a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"ma= rgin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:= 1ex"><div>hello<div><br></div><div>Wazuh is open source and can be integrat= ed with many environments. It does not support Slackware natively, but I=E2= =80=99m sure it can be adapted.=C2=A0</div><div><br></div><div><a href=3D"h= ttps://github.com/wazuh/wazuh" rel=3D"noreferrer noreferrer" target=3D"_bla= nk">https://github.com/wazuh/wazuh</a></div><div><br></div><div>There is a = very active slack community where you can interact with other people using = it.=C2=A0</div><div><br></div><div><a href=3D"https://wazuh.com/community/j= oin-us-on-slack/" rel=3D"noreferrer noreferrer" target=3D"_blank">https://w= azuh.com/community/join-us-on-slack/</a><br></div><div></div><div><br></div= ><div>gabriel</div><div><br></div><div><br><div><br><blockquote type=3D"cit= e"><div>El 27 oct 2022, a las 13:54, Thomas Altfather Good via slackware &l= t;<a href=3D"mailto:[email protected]" rel=3D"noreferrer norefer= rer" target=3D"_blank">[email protected]</a>> escribi=C3=B3:<= /div><br><div><div dir=3D"auto"><br>Hi All,=C2=A0<div dir=3D"auto"><br></di= v><div dir=3D"auto">Has anyone gotten SentinelOne to work with Slackware?</= div><div dir=3D"auto"><br></div><div dir=3D"auto">Or - can someone recommen= d an EDR?</div><div dir=3D"auto"><br></div><div dir=3D"auto">Thanks!<br><di= v dir=3D"auto">--<br><br>Thomas Altfather Good<br><a href=3D"http://thomasg= ood.com/" rel=3D"noreferrer noreferrer" target=3D"_blank">thomasgood.com</a= ><br><br><br>Washington-Baltimore News Guild, CWA Local 32035<br>National P= ress Photographers Association<br><br>Level 6, Google Guide:=C2=A0<a href= =3D"http://google.thomasgood.com/" rel=3D"noreferrer noreferrer" target=3D"= _blank">google.thomasgood.com</a><br><br><br>=E2=80=9ELeben Sie jetzt die F= ragen.=E2=80=9C=C2=A0-- Rainer Maria Rilke<br><br><br>=C2=A0=C2=A0=C2=A0 </= div></div></div> -- <br>slackware mailing list<br><a href=3D"mailto:[email protected]= g.uk" rel=3D"noreferrer noreferrer" target=3D"_blank">[email protected]= .org.uk</a><br><a href=3D"https://mailman.lug.org.uk/mailman/listinfo/slack= ware" rel=3D"noreferrer noreferrer" target=3D"_blank">https://mailman.lug.o= rg.uk/mailman/listinfo/slackware</a><br></div></blockquote></div><br></div>= </div>-- <br> slackware mailing list<br> <a href=3D"mailto:[email protected]" rel=3D"noreferrer noreferre= r" target=3D"_blank">[email protected]</a><br> <a href=3D"https://mailman.lug.org.uk/mailman/listinfo/slackware" rel=3D"no= referrer noreferrer noreferrer" target=3D"_blank">https://mailman.lug.org.u= k/mailman/listinfo/slackware</a><br> </blockquote></div> </blockquote></div><div style=3D"white-space:pre-wrap"><div>-- <br>Sent fro= m my Android device with K-9 Mail. Please excuse my brevity.</div></div></d= iv></blockquote></div> </blockquote></div><div style=3D"white-space:pre-wrap"><div>-- <br>Sent fro= m my Android device with K-9 Mail. Please excuse my brevity.</div></div></d= iv></blockquote></div><br clear=3D"all"><br>-- <br><div dir=3D"ltr" class= =3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir= =3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr">= <div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div= dir=3D"ltr"><div>Thomas Altfather Good<br><span><a href=3D"http://thomasgo= od.com" target=3D"_blank">thomasgood.com</a></span></div><div><br><span></s= pan></div><div>Washington-Baltimore News Guild, CWA Local 32035<br>National= Press Photographers Association</div><div>Level 6, Google Guide: <a href= =3D"http://google.thomasgood.com" target=3D"_blank">google.thomasgood.com</= a><br></div><div><br>=E2=80=9ELeben Sie jetzt die Fragen.=E2=80=9C=C2=A0-- = Rainer Maria Rilke</div><div> </div><span></span><div><br></div></div></div></div></div></div></div></div= ></div></div></div></div></div></div></div></div></div></div></div></div></= div> --0000000000008f358305ec2a3255-- --===============4960930969818363499== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- slackware mailing list [email protected] https://mailman.lug.org.uk/mailman/listinfo/slackware --===============4960930969818363499==--