installing snorby running a wireshark pcap through snort

No full packet capture means little space is used over time, you still get payload saved along with alerts so you can do most of your investigations just fine.Scirius makes it very easy to manage Suricata and IDS rules.

The framework is fast thanks to ELK and Suricata.The environment is brand new (Latest Debian, beta but stable software versions, etc), it means you get the latest features both in terms of security, performance and shiny gadgets.They know what they are doing, they like it and it shows! Support for SELKS is great, the developers are proactive on IRC (#SELKS on Freenode) and github, they are refreshingly down to earth and you don't feel intimated to ask any questions.It helped building trust in a new environment/technology I was not too acquainted with before. Suricata IS different from Snort on many levels, for example it is supposed to be more performant because it supports multithreading, but having run Suricata (SELKS) and Snort (SO) in parallel for a couple of weeks I am please to report they both detected similar alerts. One of the main difference with SO, beside the ELK framework, is that SELKS only ships with Suricata, having only used Snort in the past and never Suricata (it is available on SO too) the learning curve was a bit steep (still is!), but once you realise it shares a lot with Snort such as rulesets, some config files as well as some operating logic it becomes easier to understand. Having said that, Stamus Network, the company behind SELKS, also provides professional services which may be helpful for a pro deployment. SELKS V2.0 is a great improvement from SELKS V1.0, so much so that I now consider it a serious contender to Security Onion (SO) at least for home use. SELKS is provided as a live Linux distribution based on Debian 8 (Jessie) which is also installable. The NSM core engine is provided by the first 'S' which stands for Suricata (Network IDS) and the last 'S' which stands for Scirius (Management GUI for Suricata). I have recently been testing SELKS v2.0 which is an open source Network Security Monitor (NSM) based on anĮLK framework: Elasticsearch (search and analytics engine) Logstash (log normalisation) Kibana (visualisation).

Installing snorby running a wireshark pcap through snort