arkime
Wazuh
arkime | Wazuh | |
---|---|---|
13 | 151 | |
6,122 | 9,208 | |
0.8% | 3.6% | |
9.6 | 10.0 | |
5 days ago | 4 days ago | |
JavaScript | C | |
Apache License 2.0 | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
arkime
-
Where can I get hands on practice for cybersecurity as a beginner over internet for free?
Arkime: https://arkime.com/ Packet capture and search
- NSA CSI IPv6 Security Guidance (2023) [pdf]
-
how did i do? Just a quick Mock up, and i know i need new switches, how im pretty happy with my very first homelab
Also consider running full PCAP collection with https://arkime.com/ so you can monitor your past network traffic. That has come in handy many times for security and troubleshooting, and doesn't require as much horsepower as you might think.
-
Most Valuable Tools
Anyone using Arkime? https://arkime.com/
- how is packet sniffing working ?
-
How would you add multiple filters on wireshark?
dns && ip.src==x.y.z.w Note that this display filter will not display the DNS replies for the requests sent by x.y.z.w if you want those as well then it will be dns && ip.addr==x.y.z.w Although DNS will be displayed in upper case in Wireshark, it has to be in lower case in the display filter, that said, like others said based on your exact needs and the size of your resulting pcap / pcapng file you may want to look at capture filters, finally if you are dealing with multiple gegabytes file(s) you may want to take a look at another tool like Arkime (formerly moloch) https://arkime.com/
-
I'm currently studying to transition from a SIEM administrator to a network forensics analyst. What's are good workflows/resources for analyzing PCAPs?
Full PCAP's? Look at https://arkime.com/ or network miner. Arkime is probably more what you're looking for. But I love network miner
-
Wireshark pcap in elastic search
I used moloch which is now https://arkime.com/. It used to be free and was a great tool for pcaps. Uses elastic underneath.
-
IT Pro Tuesday #155 - Carrier Lookup, Network Podcast, Identification Tool & More
Arkime is secure, scaleable, indexed packet capture and search tool that can improve your network security by providing greater visibility. This open-source tool stores and indexes network traffic in standard PCAP format. Our thanks for the suggestion goes to Security_Chief_Odo.
-
Cisco Network Traffic to Graylog
I would suggest instead of graylog look into something like this https://arkime.com/
Wazuh
-
Exclude certain CIS (sca) rules from agents
There is currently no feature for excluding specific SCA rules however this feature has been requested here and would be added to the roadmap for future releases.
- Deployment issue
-
Greenbone
I use Wazuh instead. Greenbone CE is severely limited and requires payment for anything beyond the very basic. Super simple installation more features.
-
Update vulnerability databases through proxy with authentication
Seems like something that should be documented somewhere more official than a random reddit post for sure. Added it to https://github.com/wazuh/wazuh/issues/1112 for good measure.
-
💻 Introducing Wazuh 4.7.0.
Hmm, I've really been wanting to try Wazuh but since all our endpoints (Win10/11) are running a German locale I've run into https://github.com/wazuh/wazuh/issues/16842 when checking the compliance checks (CIS benchmarks) on a test installation of 4.6.
-
Risks of hosting a website out of my house
Monitoring & Active Measures - Exporting firewall events to an external time-series database like I describe above is good to see who is touching your firewall or accessing your web site. Using an Intrusion Detection System / Intrusion Prevention System (IDS/IPS) such as open-source Suricata, which is a free package on pfSense, and deploying file system integrity monitoring, such as the open-source Wazuh on the exposed server are also good approaches to protecting yourself.
-
Ignore Vulnerability for specific CVE?
We are actively working on enhancing the system to allow users to mark vulnerabilities as "not vulnerable" or hide them. You can track the progress of this enhancement on the following GitHub issue: (Enhancement - Mark Vulnerabilities as Not Vulnerable).
- Account LockOuts
-
advice on building a vulnerability management dashboard
Hello, thanks for using Wazuh, I will try to answer your questions: 1- I am going to check with the team in charge to see if there is a way. 2- Untriaged is a default value that is placed on vulnerabilities that do not have low, medium or high values https://github.com/wazuh/wazuh/issues/12675 3- As in the previous point, the providers of vulnerability lists have not provided the data.
-
Agents keep trying to re-register and event queues filling
Agents getting frequently pending and disconnecting
What are some alternatives?
securityonion - Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, and case management. It also includes other tools such as Playbook, osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
security-onion - Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
Suricata - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
luci-wrtbwmon - Bandwidth tracker for OpenWRT that uses wrtbwmon
OSSEC - OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
pyWhat - 🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙♀️
openvas-scanner - This repository contains the scanner component for Greenbone Community Edition.
nsp
Snort - Snort++
node_pcap - libpcap bindings for node
crowdsec - CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.