Sophos XG comes with pre-defined Intrusion Prevention System (IPS) policies but you can easily create one tailored specifically for your needs. The benefit is so the IPS engine is not scanning your traffic against more signatures than necessary, thus reducing overall system load. As a comparison, the pre-defined ‘lantowan_general’ policy has 7,181 signatures in its IPS policy rule compared to the custom IPS policy we’ll create below with 1,520 signatures which covers a basic home network without any servers or Micosoft Windows platforms.

• Sophos Ips Snort
• Snort Sophos Xg

1. Access the ‘IPS Policies’ tab on the ‘Intrusion Prevention’ page and click ‘Add’.

2. Provide a ‘Name’ for your IPS policy and description if desired. You also have the ability to clone another IPS policy but for this example, we’ll create one from scratch so click ‘Save’.

This article describes where logs detailed in the WebAdmin can be found in the Shell and where to find their associated service scripts. Amazon Affiliate Store ️ we used on Kit (affiliate Links) ️ ITProTV.

3. Open your newly created IPS policy. From here, add a rule for the IPS policy to utilize by clicking ‘Add’.

4. Provide a ‘Rule Name’ and now select which signatures you want your rule to utilize by first starting with the category. Click ‘Category’ which will display a drop down with several options. Select the appropriate categories for your needs but in this example, select the following categories and click ‘OK’:

• Application and Software
• Browsers
• DNS
• FTP
• Malware Communication
• Misc
• Multimedia
• Office Tools
• Operating System and Services
• Reconnaissance
• VoIP and Instant Messaging
• Web Services and Applications

Note: To become familiar with what signatures fall under each filter (i.e. Category, Severity, Platform and Target), I recommend spending just a few minutes selecting each filter option individually and scroll through the signatures to become familiar with each filter option. For example, under the ‘Platform’ filter there is the option ‘Other’. Choose ‘Other’ and now pick the ‘Client’ under the ‘Target’ filter. This will list all of the signatures that apply to only client devices under the ‘Other’ platform filter. Scrolling through the list, you can now see what type of signatures apply.

5. Next, click ‘Severity’ and choose which severity level you want the IPS policy to utilize. For this example, select ‘All’ and click ‘OK’.

6. Click ‘Platform’ and choose the operating systems you have on your network and click ‘OK’.

7. Click ‘Target’, only choose ‘Client’ since we don’t have any servers and click ‘OK’. Your IPS policy rules should look something like this:

8. ‘Select All’ will be checked by default. As the name implies, this will choose all signatures for the categories, severity, platform and target selected above. If required to disable a specific signature, choose ‘Select Individual Signature’ and now you can individually select which signatures you want to enable or disable. For this example, leave ‘Select All’ checked.

Note: The ‘Smart Filter’ is available as an additional filter only when ‘Select All’ is chosen. The smart filter allows you to type in the partial or full name of a signature and only those specific signatures will be utilized for your IPS policy rule.

9. The last option is ‘Action’ which allows you to specify what the IPS engine will do when a matching signature is detected. Setting this to ‘Recommended’ will use the ‘Recommended Action’ for the individual signature.

10. Click ‘Save’ at the bottom and now open your desired firewall rule and make sure this IPS policy is selected.

That’s it! Sophos XG uses Snort for its IPS engine which is a open-source, widely used network instruction detection and prevention system. Currently, Snort does not support multi-threading so it’s limited to only using one CPU core for traffic scanning. However, Sophos XG runs multiple instances of Snort for each CPU core. You can view this by running ‘show ops-engine’ from the console which will show you the number of IPS instances.

You can see in the above screenshot there are four IPS instances running on each CPU core. While this is beneficial in increasing overall performance of Sophos XG, it’s important to note that only one IPS instance will apply to an individual connection. For example, without IPS enabled, my internet connection speeds are 900Mbps/50Mbps. With IPS enabled, speeds drop down to 300Mbps/50Mbps (Intel Core i5-5250U). When running these speed tests, only one IPS instance is being utilized because Snort is not multi-threaded causing a fairly significant drop in internet speeds. However, with multiple connections running at the same time, having multiple IPS instances obviously becomes beneficial such that the workload can be divided up among the four IPS instances.

Originally written by Joe Schreiber, re-written and edited by Guest Blogger, re-re edited and expanded by Rich Langston

Whether you need to monitor hosts or the networks connecting them to identify the latest threats, there are some great open source intrusion detection (IDS) tools available to you.

List of Open Source IDS Tools

• Snort
• Suricata
• Bro (Zeek)
• OSSEC
• Samhain Labs
• OpenDLP

IDS Detection Techniques

There are two primary threat detection techniques: signature-based detection and anomaly-based detection. These detection techniques are important when you’re deciding whether to go with a signature or anomaly detection engine, but vendors have become aware of the benefits of each, and some are building both into their products. Learning their strengths and weaknesses enables you to understand how they can complement one another.

Signature-based IDS Tools

With a signature-based IDS, aka knowledge-based IDS, there are rules or patterns of known malicious traffic being searched for. Once a match to a signature is found, an alert is sent to your administrator. These alerts can discover issues such as known malware, network scanning activity, and attacks against servers.

Unified Security Management

One platform combining the essential security capabilities, including IDS, asset discovery, and SIEM log management.

Anomaly-based IDS Tools

With an anomaly-based IDS, aka behavior-based IDS, the activity that generated the traffic is far more important than the payload being delivered. An anomaly-based IDS tool relies on baselines rather than signatures. It will search for unusual activity that deviates from statistical averages of previous activities or previously seen activity. For example, if a user always logs into the network from California and accesses engineering files, if the same user logs in from Beijing and looks at HR files this is a red flag.

Both signature-based and anomaly-based detection techniques are typically deployed in the same manner, though one could make the case you could (and people have) create an anomaly-based IDS on externally-collected netflow data or similar traffic information.

Advantages and Disadvantages

Fewer false positives occur with signature-based detection but only known signatures are flagged, leaving a security hole for the new and yet-to-be-identified threats. More false positives occur with anomaly-based detection but if configured properly it catches previously unknown threats.

Network-Based IDS (NIDS)

Network-based intrusion detection systems (NIDS) operate by inspecting all traffic on a network segment in order to detect malicious activity. With NIDS, a copy of traffic crossing the network is delivered to the NIDS device by mirroring the traffic crossing switches and/or routers.

A NIDS device monitors and alerts on traffic patterns or signatures. When malicious events are flagged by the NIDS device, vital information is logged. This data needs to be monitored in order to know an event happened. By combining this information with events collected from other systems and devices, you can see a complete picture of your network’s security posture. Note that none of the tools here correlate logs by themselves. This is generally the function of a Security Information and Event Manager (SIEM).

Snort

Ah, the venerable piggy that loves packets. Many people will remember 1998 as the year Windows 98 came out, but it was also the year that Martin Roesch first released Snort. Although Snort wasn't a true IDS at the time, that was its destiny. Since then it has become the de-facto standard for IDS, thanks to community contributions.

It's important to note that Snort has no real GUI or easy-to-use administrative console, although lots of other open source tools have been created to help out, such as BASE and Sguil. These tools provide a web front end to query and analyze alerts coming from Snort IDS.

Snort Summary

• Long product life with no signs of going away
• Great community support
• Plenty of administrative front-ends
• Thoroughly proven and tested
• Great community support
• According to Snort’s website, features include:
  • Modular design:
  • Multi-threading for packet processing
  • Shared configuration and attribute table
  • Use a simple, scriptable configuration
  • Plugin framework, make key components pluggable (and 200+ plugins)
  • Auto-detect services for portless configuration
  • Auto-generate reference documentation
  • Scalable memory profile
  • Rule parser and syntax (support sticky buffers in rules)
• Documentation:
  • A Snort Cheatsheet
  • A plugin for Snort is available for AlienVault USM Anywhere.

Suricata

What's the only reason for not running Snort? If you're using Suricata instead. Although Suricata's architecture is different than Snort, it behaves the same way as Snort and can use the same signatures. What's great about Suricata is what else it's capable of over Snort. It does so much more, it probably deserves a dedicated post of its own.

There are third-party open source tools available for a web front end to query and analyze alerts coming from Suricata IDS.

Suricata Summary

• Multi-Threaded - Snort runs with a single thread meaning it can only use one CPU(core) at a time. Suricata can run many threads so it can take advantage of all the cpu/cores you have available. There has been much contention on whether this is advantageous, Snort says No and a few benchmarks say Yes.
• Built in Hardware Acceleration - Did you know you can use graphic cards to inspect network traffic?
• File Extraction - Someone downloading malware? You can capture it right from Suricata and study it.
• LuaJIT - It's a lot of letters yes, but it's also a scripting engine that can be used with information from the packets inspected by Suricata. This makes complex matching even easier and you can even gain efficiency by combining multiple rules into one script.
• Logging more than packets - Suricata can grab and log things like TLS/SSL certs, HTTP requests, DNS requests
• Great community support
• According to Suricata’s website, features include:
  • High performance - multi-threaded, scalable code base
  • Multipurpose Engine - NIDS, NIPS, NSM, offline analysis, etc.
  • Cross-platform support - Linux, Windows, macOS, OpenBSD, etc.
  • Modern TCP/IP support including a scalable flow engine, full IPv4/IPv6, TCP streams, and IP packet defragmentation
  • Protocol parsers - packet decoding, application layer decoding
  • HTTP engine - HTTP parser, request logger, keyword match, etc.
  • Autodetect services for portless configuration
  • Lua scripting (LuaJIT)
  • Application-layer logging and analysis, including TLS/SSL certs, HTTP requests, DNS requests, and more
  • Built-in hardware acceleration (GPU for network sniffing)
  • File extraction
• Documentation:

Bro (renamed Zeek)

Bro, which was renamed Zeek in late 2018 and is sometimes referred to as Bro-IDS or now Zeek-IDS, is a bit different than Snort and Suricata. In a way, Bro is both a signature and anomaly-based IDS. Its analysis engine will convert traffic captured into a series of events. An event could be a user login to FTP, a connection to a website or practically anything. The power of the system is what comes after the event engine and that's the Policy Script Interpreter. This policy engine has its own language (Bro-Script) and it can do some very powerful and versatile tasks.

If you're an analyst and you've wondered 'How can I automate some of my work?' then this is the tool you've been looking for. Want to download files seen on the wire, submit them for malware analysis, notify you if a problem is found then blacklist the source and shutdown the user's computer who downloaded it? Want to track the usage patterns of a user after they've contacted an IP from a reputation database?

If you're not an analyst then this tool will have a challenging learning curve. Since it was developed as a research tool, it didn't initially focus on things like GUIs, usability, and ease of installation. While it does numerous cool things out of the box many of those things aren't immediately actionable and may be difficult to interpret.

There’s no native GUI but there are third-party open source tools available for a web front end to query and analyze alerts coming from Bro-IDS. Consider ELK stack.

Bro Summary

• Complicated to set up
• Can detect patterns of activity other IDS systems can not
• Very extensible architecture
• Good community support
• According to Bro’s website, features include:
  • Comprehensive traffic logging and analysis
  • Powerful and flexible event-driven scripting language (Bro scripts)
  • Deploys on UNIX-style systems, including Linux, FreeBSD, and MacOS
  • DNS/FTP/HTTP/IRC/SMTP/SSH/SSL/other protocol support
  • Fully passive traffic analysis with network tap or monitoring port
  • Real-time and offline analysis
  • Cluster-support for large-scale deployments
  • Comprehensive IPv6 support
  • IDS-style pattern matching
  • File extraction
  • Extensible architecture
  • Analysts can use Bro for automation (file extraction, malware analysis, blacklisting, track usage patterns, research work, etc.)
• Documentation:

Host-based IDS (HIDS)

Host-based intrusion detection systems (HIDS) work by monitoring activity occurring internally on an endpoint host. HIDS applications (e.g. antivirus software, spyware-detection software, firewalls) are typically installed on all internet-connected computers within a network, or on a subset of important systems, such as servers. This includes those in public cloud environments.

HIDS search for unusual or nefarious activities by examining logs created by the operating system, looking for changes made to key system files, tracking installed software, and sometimes examining the network connections a host makes.

The first HIDS systems were basic, usually just creating MD5 hashes of files on a recurring basis and looking for discrepancies, utilizing a process dubbed file integrity monitoring (FIM). Since then, HIDS have grown far more complex and perform a variety of useful security functions and will continue to grow. This includes modern Endpoint Response (EDR) capabilities.

If your organization has a compliance mandate, such as for PCI DSS, HIPAA, or ISO 27001, then you may require HIDS to demonstrate file integrity monitoring (FIM) as well as active threat monitoring.

OSSEC

In the realm of full-featured open source HIDS tools, there is OSSEC and not much else. The great news is OSSEC is very good at what it does and is rather extensible.

OSSEC runs on almost any major operating system and includes client/server based management and logging architecture, which is very important in a HIDS system. Since local HIDS can be compromised at the same time the OS is, it is very important security and forensic information leave the host and be stored elsewhere asap to avoid any kind of tampering or obfuscation that would prevent detection.

OSSEC's client/server architecture incorporates this strategy by delivering alerts and logs to a centralized server where analysis and notification can occur even if the host system is taken offline or compromised. Another advantage of client/server architecture is the ability to centrally manage agents from a single server. Since deployments can range from one to thousands of installations, the ability to make global changes from a central server is critical for an administrator's sanity.

When discussing OSSEC (and other HIDS) there is often anxiety over installing an agent or software on critical servers. It should be noted that the installation of OSSEC is extremely light (the installer is under 1MB) and the majority of analysis actually occurs on the server which means very little CPU is consumed by OSSEC on the host. OSSEC also has the ability to send OS logs to the server for analysis and storage, which is particularly helpful on Windows machines that have no native and cross-platform logging mechanisms.

OSSEC Summary:

• Agents for almost every OS
• Compiled Agent for Windows
• Lots of functionality than just FIM
• Rigid but simple installation process
• Good community support
• According to OSSEC’s website, features include:
  • File integrity monitoring (FIM)
  • Log monitoring collects, analyzes, and correlates system logs
  • Rootkit detection, which searches for system modifications similar to rootkits
  • Active response can invoke automated response action when alerts are triggered
  • Client/Server architecture
  • Multi-platform support (Linux, Solaris, Windows, MacOS, etc.)
  • Supports compliance requirements for FIM
  • Real-time and configurable alerts
  • Integration with current infrastructure
  • Centralized server for mass policy management
  • Agent and agentless monitoring
• A plugin for OSSEC is available for AlienVault USM Anywhere. To learn more, read here.
• Documentation:

Samhain Labs

Samhain is probably the only HIDS open-source that gives OSSEC a run for its money. But it’s very much the case of “same but different” when comparing the two. Samhain has the same client/server architecture but doesn’t require it as OSSEC does. The agent itself has a variety of output methods, one being a central log repository but includes others like Syslog, Email, and RDBMS. There is even an option to use Samhain as a standalone application on a single host.

Another important difference is where analysis occurs. Unlike OSSEC, the processing occurs on the client itself, which has operational implications. From a practical point of view, care must be taken it doesn’t overload a busy server and interfere with operations. From the security point of view, having the brains on the endpoint invites hackers to deactivate the tool so warnings aren’t issued.

Samhain Summary:

Sophos Ips Snort

• Harder to install
• Windows clients require Cygwin
• Great FIM functionality
• More flexible client
• Okay community support
• According to Samhain’s website, features include:
  • File integrity monitoring (FIM)
  • Log file monitoring and analysis
  • Rootkit detection
  • Port monitoring
  • Detection of rogue SUID executables and hidden processes
  • Multi-platform support
  • Centralized logging and maintenance
  • Client/Server architecture (mostly)
  • Variety of output methods (e.g. syslog, email RDBMS)
  • Can be used as a standalone application on a single host
• Documentation:

File Integrity Monitoring (FIM Only)

Many file integrity monitoring (FIM) tools get categorized with HIDS since FIM involves threat detection, so let’s talk about them. FIM is tool that validates operating system and specified application file integrity by comparing current versions with known valid versions, alerting your administrator whenever they are modified. This is important because changes on critical servers often signal a breach has occurred. If you are still wondering “what is file integrity monitoring and why do I need it?”, we have an entire blog post explaining why.

Some FIM are actively developed while others haven't been updated in years. Open Source Tripwire and AFICK are two open-source FIM products options. For standalone Unix-based systems, consider checking out rootkit-finding file integrity checkers, such as chkrootkit, rkhunter, or Unhide. The unique rootkit-finding mechanism makes these solutions worth considering. Proprietary solutions are also available for Windows.

AlienVault Unified Security Management (USM) Platform provides built-in FIM capabilities to drive threat detection technologies and accelerate your cybersecurity compliance efforts. To learn more about how AlienVault USM uses FIM to protect your assets, read here.

Final Thoughts

Snort Sophos Xg

Hopefully this guide has helped you understand some of your open source options. As shown here, there has never before been so many choices or a broader set of tools available. With careful planning, and a plan for ongoing maintenance, you can build a secure network with these tools. With careful planning, and a plan for ongoing maintenance, you can build a secure netork with these tools.