OSSEC VS arkime

Does the ossec system (www.ossec.net) not use ClamWin?

OSSEC: https://www.ossec.net/ HIDS

Hi there, as per title i am trying to use this script: https://github.com/ossec/ossec-hids/blob/master/active-response/cloudflare-ban.sh

OSSEC is good for monitoring logs, system files, etc. as well as alerting (and blocking traffic if you want) when anything suspicious happens

Takes a bit of work to set up but is worth it and includes lots of basic checks by default

https://www.ossec.net/

It's been a long time since I tried using OSSEC but maybe that would help. It's a Host-based IDS, rather than a network based IDS like Snort. Last time I checked you could point it towards your logs and it will parse them offline similar to how Snort can read a PCAP file.

Not sure if it could be considered one but maybe OSSEC Host Intrusion Detection System might get you some.of the way can be found here

WAZUH (fork of OSSEC would be my first choice when it comes to Linux based HIDS (host based), and Snort or Suricata if you are looking for NIDS (network based). As well as Lynis for ensuring the setup of the host is as you intended.

Arkime: https://arkime.com/ Packet capture and search

Also consider running full PCAP collection with https://arkime.com/ so you can monitor your past network traffic. That has come in handy many times for security and troubleshooting, and doesn't require as much horsepower as you might think.

Anyone using Arkime? https://arkime.com/

dns && ip.src==x.y.z.w Note that this display filter will not display the DNS replies for the requests sent by x.y.z.w if you want those as well then it will be dns && ip.addr==x.y.z.w Although DNS will be displayed in upper case in Wireshark, it has to be in lower case in the display filter, that said, like others said based on your exact needs and the size of your resulting pcap / pcapng file you may want to look at capture filters, finally if you are dealing with multiple gegabytes file(s) you may want to take a look at another tool like Arkime (formerly moloch) https://arkime.com/

Full PCAP's? Look at https://arkime.com/ or network miner. Arkime is probably more what you're looking for. But I love network miner

I used moloch which is now https://arkime.com/. It used to be free and was a great tool for pcaps. Uses elastic underneath.

Arkime is secure, scaleable, indexed packet capture and search tool that can improve your network security by providing greater visibility. This open-source tool stores and indexes network traffic in standard PCAP format. Our thanks for the suggestion goes to Security_Chief_Odo.

I would suggest instead of graylog look into something like this https://arkime.com/