NethServer Version: 7.6.1810 (final)
Module: IPS.
Is there a way to use snort instead of suricata in Nethserver 7.
IT noob, I am sorry if this sounds very obvious or redundant.
We came from snort. Here is a discussion we had about the switch from snort to suricata: Suricata on NethServer? @filippo_carletti can tell you more about the process of changing from snort to suricata.
Most important feature to choose suricata over snort: multi thread (cores) support.
long story short: at the moment suricata is supported and not snort.
instead of installing the IDS (suricata) module, you still can install snort by following the (official) snort install guide for centos 7: https://snort.org/documents
2 Likes
Thank you @robb, for the insight,
The reason I asked this question in the first place, we were used to using snort, and it did not need much of a configuration. But while testing nethserver and suricata, I realized that the more rules I select for suricata,
I lost access to some parts in the nethserver gui (If I select all rules the whole gui becomes inaccessible).
Is there some sort of a guide to configure suricata in nethserver for an office environment?
Or should I select less rules in suricata, and run snort alongside?
Please give me suggestions.
1 Like