ARMING SMALL SECURITY PROGRAMS: NETWORK BASELINE GENERATION AND ALERTS WITH BROPY

No ratings

Presented at Nolacon 2017 by

Matt Domko

Anomaly based IDS tools are expensive. Signature based IDS tools only work if a signature exists. Using a simple Bro script, organizations without large security budgets can generate alerts for anomalous packets IF they have a complete baseline of the ports and protocols their devices use. I wrote Bropy to simplify the process of generating a network baseline to be used with my baselinereport bro script.With this tool, small security teams can generate network baselines for systems in a matter of minutes, rather than hours or days. Armed with the data generated by Bropy, organizations have the option to...