SpamAssassin
OSSEC
Our great sponsors
SpamAssassin | OSSEC | |
---|---|---|
8 | 12 | |
275 | 4,253 | |
1.5% | 0.9% | |
8.5 | 4.5 | |
7 days ago | about 1 month ago | |
Perl | C | |
Apache License 2.0 | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
SpamAssassin
-
Ok, I've migrated email to selfhosted
spamassassin or rspamd or ASSP. All very good. Spamassassin just works, but you need to feed it a good cohort of spam and ham (about 1000 messages each). Most people only send it the spam which will then bias it quite a bit and not have it classify spam as spam unless it's the worst of the bunch. Spamassassin is a filter for your mail server. rspamd is the same idea. ASSP is highly configurable and a proxy.
-
Why Your Emails May Be Bouncing Back & What You Can Do About It
To detect whether incoming emails are malicious, mail servers also use spam scanners, such as Apache's popular SpamAssasin. The internal workings of these spam scanners can be somewhat complicated (involving Naive Bayes Classifiers on trained, large datasets, for the curious), but the primary takeaway is that these classification systems typically assign a numerical point value to an incoming email to determine the validity of the message. The higher the score, the more likely that the email is spam. For reference, the ISP Optimum states the following regarding their spam filtering:
OSSEC
-
Where can I get hands on practice for cybersecurity as a beginner over internet for free?
OSSEC: https://www.ossec.net/ HIDS
-
Passive log analysis software
It's been a long time since I tried using OSSEC but maybe that would help. It's a Host-based IDS, rather than a network based IDS like Snort. Last time I checked you could point it towards your logs and it will parse them offline similar to how Snort can read a PCAP file.
-
Free EDR solutions
Not sure if it could be considered one but maybe OSSEC Host Intrusion Detection System might get you some.of the way can be found here
-
Intrusion detection software?
WAZUH (fork of OSSEC would be my first choice when it comes to Linux based HIDS (host based), and Snort or Suricata if you are looking for NIDS (network based). As well as Lynis for ensuring the setup of the host is as you intended.
-
cnHids stake pool security monitoring- now available as scripted install.
cnhids is a Host Intrusion Detection System for cardano node based on https://github.com/ossec/ossec-hids:
What are some alternatives?
Wazuh - Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Suricata - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
Fail2Ban - Daemon to ban hosts that cause multiple authentication errors
OSQuery - SQL powered operating system instrumentation, monitoring, and analytics.
crowdsec - CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.
Snort - Snort++
lynis - Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
pfSense - Main repository for pfSense
Kippo - Kippo - SSH Honeypot
Pen Test Tools - Homebrew Tap - Pen Test Tools