How To Incident Response

From	"lannoun@runbox.com" <lannoun@runbox.com>
Newsgroups	linux.debian.security
Subject	How To Incident Response
Date	2017-05-12 16:40 +0200
Message-ID	<tGjTA-5TF-15@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi,
I'm performing installation for a "secure" web app.

I'm starting with psad, and suricata.

Now I'd like to install Sguil or Snorby or any alternative for packet 
capturing. My problem is that I have to compile myself which we know is 
not the best solution for security.

Does any alternative exists?

Also, Which tool can mail me if there are any alerts?

Any other tools that I should consider?

Thanks for your help

Liam.

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

How To Incident Response "lannoun@runbox.com" <lannoun@runbox.com> - 2017-05-12 16:40 +0200
  Re: How To Incident Response Gunnar Wolf <gwolf@debian.org> - 2017-05-12 19:10 +0200
    Re: How To Incident Response "lannoun@runbox.com" <lannoun@runbox.com> - 2017-05-13 10:40 +0200

csiph-web