search

sonofagl1tch / AWSDetonationLab

This script is used to generate some basic detections of the aws security services
Apache License 2.0
71 stars 12 forks source link

add bro visibility to detlab #41

Open sonofagl1tch opened 5 years ago

sonofagl1tch commented 5 years ago

currently, network visibility is pretty weak. So I want to add bro and suricata/snort to my detlab.

https://github.com/Security-Onion-Solutions/security-onion/wiki/CloudClient

sonofagl1tch commented 5 years ago

after some research, it appears that bro does not support windows. This means that we cannot install bro sensors on each endpoint in the network for grainular visibility of network traffic. My next idea is to look into the possibility of creating a TAP for the detlab VPC and hooking a system running BRO off of that TAP.