Seven Cool Open Source Projects for Defenders

Long-time blog readers should know that I don't rely on tools to defend my enterprise. I rely on people first, followed by tools, then processes. However, today I took a moment to consider the myriad of really cool work happening (mainly) in the open source tool community. When I started counting, I found about seven projects that are likely to help you defend your enterprise.

Most of these require some commitment of brainpower and willingness to learn, but I am nevertheless very pleased to see this much innovation on the defensive side. Collectively these projects do not "solve" any problems (nor should they), but I am certain they can help address one or more problems you may encounter -- especially regarding visibility. In other words, these are the sorts of tools (with one or two exceptions) that will help you detect and respond to intruders.

These are numbered for reference and not for priority.

  1. Charles Smutz recently announced his Ruminate IDS, whose goal is to "demonstrate the feasibility and value of flexible and scalable analysis of objects transferred through the network." Charles is also author of the Vortex prohect, a "a near real time IDS and network surveillance engine for TCP stream data."

  2. Doug Burks just released a new version of SecurityOnion, an Ubuntu-based live CD to facilitate network security monitoring. You'll find many of the tools on this list in SO and I expect those missing will be included at some point!

  3. Over at Berkeley, development of the Bro IDS project is kicking into high gear with Seth Hall's new role as a full-time developer. We miss you Seth!

  4. OISF just released a new version of their Suricata IDS. If you're going to RSA next month, see the OISF team at their next Brainstorming Session. I plan to stop by.

  5. Dustin Webber and new team member Jason Meller just released a new version of Snorby, a Web 2.0 interface for Snort alerts. I hope to see Snorby packaged in SO soon.

  6. Edward Bjarte Fjellskål continues to release cool new code, from the packet capture system OpenFPC with Leon Ward to Polman for managing IDS rules.

  7. Sourcefire's Razorback framework seems to be making some progress again, and the relaunch of new Snort, VRT, and ClamAV blogs under new community manager Joel Esler is a welcome move.


Check these out if you have some time!

Comments

Unknown said…
Anything new happening with SGUIL? It's been stuck at 0.7 for SOOOOOO VERY LONG!!
9:43 PM
philippe said…
what about ossec? really like that one personally
11:36 PM
Unknown said…
well ... to answer both mr_clark and philippe at the same time :

http://www.ossec.net/dcid/?p=113

there's a new beta agent that takes ossec logs from alerts.log and feeds them into sguil.

for completeness sake :
http://www.sguil.net/
http://www.ossec.net/

OSSEC has also been added to Security Onion.
7:42 AM
Anonymous said…
Thank you Richard for your kind comments, hopefully I am making progress
11:32 AM
bamm said…
Man, I've been getting beat up about this again and again. I am working on getting a new release out. Really.
12:30 PM
David said…
On bro: I've done a bit of hacking on it and a set of policy scripts to help with retrospective analysis. I just posted what I had in my fossil repo to chiselapp (not sure how stable they are...): http://chiselapp.com/user/potatohead/repository/NSM_Dino/index

Specifically of interest:
- Generic notes and output format: http://chiselapp.com/user/potatohead/repository/NSM_Dino/wiki?name=dvessey-misc-bro

- Easy steps to follow to run on a collection of PCAPs: http://chiselapp.com/user/potatohead/repository/NSM_Dino/wiki?name=dvessey-bro-analysis-howto


The output formats used were meant to make inserting in a SQL database easier. As I moved through development, I figured it would probably be better to split stuff up into multiple tables for sampling then use a merge table for querying your whole dataset.

Cheers! Let me know if you find it useful!
8:01 PM
Doug Burks said…
Richard--Thanks for mentioning Security Onion!

Wim--The OSSEC Agent for Sguil is actually not new; it has been around since 2007. It's still in "beta", but seems to perform properly.

All--If you have any questions or suggestions for Security Onion, please let me know.

Thanks,
Doug Burks
http://securityonion.blogspot.com
6:25 AM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more