#suricata — Public Fediverse posts

i wanted to try out the new #astra model from #openai so i worked back and forth with it on a janky little script to convert eve.json from #suricata to #mitre ILF, then i had it generate a pile of tests: https://github.com/cmhobbs/suricata2ilf

it's... fine? i guess? doesn't seem like a wild improvement over sol to me. much how #fable and #opus 5 didn't feel like terribly useful leaps to me.

a lot of this #ai stuff feels like mega-hype and i feel crazy when it doesn't work for me.

i wanted to try out the new #astra model from #openai so i worked back and forth with it on a janky little script to convert eve.json from #suricata to #mitre ILF, then i had it generate a pile of tests: https://github.com/cmhobbs/suricata2ilf

it's... fine? i guess? doesn't seem like a wild improvement over sol to me. much how #fable and #opus 5 didn't feel like terribly useful leaps to me.

a lot of this #ai stuff feels like mega-hype and i feel crazy when it doesn't work for me.

i wanted to try out the new #astra model from #openai so i worked back and forth with it on a janky little script to convert eve.json from #suricata to #mitre ILF, then i had it generate a pile of tests: https://github.com/cmhobbs/suricata2ilf

it's... fine? i guess? doesn't seem like a wild improvement over sol to me. much how #fable and #opus 5 didn't feel like terribly useful leaps to me.

a lot of this #ai stuff feels like mega-hype and i feel crazy when it doesn't work for me.

I seem to be seeing that the #ip #ipv4 addresses of some legit #reticulum #nodes are being included in some of the lists used by #suricata #IDS #intrustiondetectionsystem to #blacklist IP addresses, and so they might well end up blocked by your #firewall or #IPS #intrusionprotectionsystem
in particular e.g. database #CINS might be flagging mesh nodes
Please take steps for port 4242
#port4242 normally used by #rns #reticulum to not let bad data spoil the #mesh #nomadnet #meshchat #meshchatx

Background:
for my #homelab I set up #suricata in #nixos and have a functioning #ids #intrusiondetection system with a #grafana dashboard (#flake info here https://codeberg.org/adingbatponder/reticulum_nixos_flake/src/commit/9ebc4cd68ba461b0baad990cbdd4a4ef50b57045/features/network-appliance/README.md ).
Preliminary plan:
I now want to go to and #ips #intrusionprevention system that blocks threats detected. Current plan is #nftables with #nfqueue but there is no GUI for that it seems, and it is a bit clunky and black-boxy.
Question: What are the more user-friendly options for an IPS front-end / GUI ?
Thanks!

Made a transparent network bridge on #NixOS which sits between router & #LAN switch, monitoring traffic for #IDS #intrusiondetection , #Suricata and #Zeek capture and analyze packets → #Filebeat ships #logs → #Elasticsearch with #GeoIP ingest pipeline → #Grafana setup of dashboard to visualise data is defined in flake itself so using the flake will give the same dashboard. #flake details here https://codeberg.org/adingbatponder/reticulum_nixos_flake/src/branch/main/features/network-appliance
Hardware: HP EliteDesk 800 G1 SFF 16Gb RAM & https://www.jacob.de/produkte/Intel-Ethernet-Server-Adapter-I350-T4-I350T4V2-artnr-2094756.html #i350t4

Cyber threats are becoming more advanced every day, making it crucial to stay informed and prepared. Social engineering and deepfake attacks are two significant concerns that require robust security measures.
https://linuxexpert.org/cybersecurity-rising-threats-and-how-to-protect-against-them/
#Cybersecurity #SocialEngineering #DeepfakeAttacks #ZeroTrust #ContinuousMonitoring #LinuxSecurity #NetworkSecurity #OpenSourceSecurity #MFA #SecurityTraining #IntrusionDetection #OSSEC #Suricata #OpenLDAP #LeastPrivilege #GnuPG #ITSecurity #linux

The deadline is fast approaching! Have interesting ideas the #Suricata InfoSec community might want to hear? Share them at #SuriCon2024! Apply today to talk at our upcoming SuriCon. 📣 Submit by June 15th! https://suricon.net/call-for-talks/

#Call4Talks #SuriCon

Attention! 📢 We are looking for Suricata users, developers, product managers, integrators, researchers, and more, interested in sharing their innovative work with Suricata’s global open-source community at this upcoming SuriCon. Our call for talks is now open! #SuriCon2024 #Suricata #Call4Talks

Working on something interesting? Submit today! https://suricon.net/call-for-talks/