ElastiFlow
DISCONTINUED
Wazuh
Our great sponsors
ElastiFlow | Wazuh | |
---|---|---|
31 | 151 | |
2,311 | 8,876 | |
- | 7.5% | |
4.1 | 10.0 | |
over 2 years ago | about 21 hours ago | |
Shell | C | |
GNU General Public License v3.0 or later | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
ElastiFlow
- NETFLOW .. NTOPNG how to ?
-
Threat detection
One thing I ran for a while was security onion and utilized port mirroring to mirror the uplink port from my primary switch to my LAN on my router, so I was catching anything coming into/out of my network destined for internet. I've also used ElastiFlow ( https://github.com/robcowart/elastiflow ) which is absolutely phenomenal and awesome, I did the same and it provides some great data. You could also leverage IntelOwl ( https://github.com/intelowlproject/IntelOwl ) , one thing I have added to all my VMs is a OSSEC agent, Wazuh to be specific which is free ( https://github.com/wazuh/wazuh ) and while I am not using it to its full potential such as monitoring file deletions/modifications etc it is a powerful tool.
- Linux Network Traffic Monitor
-
Netflow bit rate and Interface Bit Rate
https://github.com/robcowart/elastiflow/issues/201 https://github.com/robcowart/elastiflow/issues/52
- Network Traffic visualization
-
Installation help, almost there.
Looks like that's deprecated, https://github.com/robcowart/elastiflow/ Any reason not to try the new one? https://docs.elastiflow.com/docs/
Where as the newer version is (https://github.com/robcowart/elastiflow/) is called:
-
Looking for a netflow monitoring solution
Whilst elastiflow has moved on and become more 'commercial', the original Github source remains, and has a lot of very useful information for setting it up. Works very well with sflow/netflow/ipfix. I have pfSense, and JunOS exporting to a Ubuntu 18.04 running Elastic 7.14.
-
Netflow Monitoring Software Based on FLOSS
Elastiflow
- Sflow (Docker Preferably)
Wazuh
-
Update vulnerability databases through proxy with authentication
By now I've set up the offline updates part and ran straight into https://github.com/wazuh/wazuh/issues/20573 when I also tried to enable the Ubuntu checks. FML.
I've found https://github.com/wazuh/wazuh/issues/1112 which suggested to basically include the "http_proxy" and "https_proxy" environment variable definitions in "/lib/systemd/system/wazuh-manager.service" (updated path compared to the github issue).
Seems like something that should be documented somewhere more official than a random reddit post for sure. Added it to https://github.com/wazuh/wazuh/issues/1112 for good measure.
-
Risks of hosting a website out of my house
Monitoring & Active Measures - Exporting firewall events to an external time-series database like I describe above is good to see who is touching your firewall or accessing your web site. Using an Intrusion Detection System / Intrusion Prevention System (IDS/IPS) such as open-source Suricata, which is a free package on pfSense, and deploying file system integrity monitoring, such as the open-source Wazuh on the exposed server are also good approaches to protecting yourself.
-
DevOps and Security: DevSecOps
Wazuh: An open source security monitoring platform that integrates with popular tools like Elasticsearch and Kibana to provide comprehensive security event analysis and response capabilities.
-
Another windows 11 thread....
If you can provide us with the following information, we will be able to better assess the problem and confirm that these warnings are caused by issue #15160:
I'm concerned you aren't fully aware of this widely discussed issue; https://github.com/wazuh/wazuh/issues/15160
-
Vulnerability overview
On another note, as mentioned in my response to the question of this post, we are working on a complete rework of the Vulnerability Detection engine. This rework will provide a sanitized CVEs feed from wazuh.com and a completely new scanner engine. It will also include a new UI for global queries.
-
Alternative to Endpoint Protector?
Maybe you can take a look at wazuh? https://wazuh.com/
What are some alternatives?
security-onion - Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
OSSEC - OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
Suricata - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
openvas-scanner - This repository contains the scanner component for Greenbone Community Edition.
Snort - Snort++
crowdsec - CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.
OSQuery - SQL powered operating system instrumentation, monitoring, and analytics.
Grafana - The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.
velociraptor - Digging Deeper....
ntopng - Web-based Traffic and Security Network Traffic Monitoring
Fleet - Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
pfSense - Main repository for pfSense