Snorby & Snort is up and running

Finally I setup my home IDS: Snort & Snorby on top. The goal: to see what is going on in my Internet traffic, is there anything interesting. Also Snort output will be collected by home Splunk instance. The screenshot below shows only test events, nothing serious 🙂 I used this guide: Home IDS with Snort … Read more

ESM ArcSight plugins – how to

Introduction I attended many sessions at the “HP Protect 2012” conference last September and one of them – the “Plug it in!” by Doron Keller (HP/ArcSight) was very interesting for me. As a former software developer, I always like any possibilities of enriching features of an existing product by writing few lines of code. Furthermore … Read more