I have regularly updated nethsever, however, since the release 1 of nethserver 7, new tools such as IPS Report and Diagnostics are shown, which do not appear on my server, in software center, I do not see any updates pending , So I would like to know if you have to do something extra to update the system version, or you can only obntener the new functions by installing from scratch.
I am sorry for my bad english.
My nethserver instalation:
The docker Nethserver:
About IPS reports, I don’t know. @flatspin was also missing it.
Maybe @filippo_carletti, who’s working on new IPS features, knows.
About diagnostic tools:
By the way, additional (community) modules can be found in the wiki
Thanks a lot!
I have the diagnostic tool now, just wait for the ips report feature. But for now thanks.
The IPS report is not compatible with suricata, so it has been removed.
A new way to handle IPS alerts is on the way:
https://evebox.org/
I’m not sure if it will be called IPS Report on the menu because it’s not a simple report, but an Inbox style alert management system.
I installed evebox as service without ELK-Stack just with internal sqlite-option.
It works. I can see the events.
I’ve no entries in inbox, escaleted and alerts. Ofcourse this can be because if the short time, but can you please tell me if eve-agent is needed for reporting? The documentation of evebox is not very detailed, so I’m not sure.
Is it planned to use evebox with ELK or without?
eve-agent is not needed.
evebox will not need ELK, I’m using sqlite. We will loose the reports. I hope support for reports without ELK will come in a future evebox version.
ELK needs a lot of ram.
Excellent this is the feature, which I am looking for.
Thanks guys, this community is the best.
