<div dir="ltr">Hello guys,<div><br></div><div style>We (ModSecurity Team) are working daily with Nick to improve Libinjection and it is fully integrated with ModSecurity. Would be very cool to see suricata integrated to ModSecurity for possible better http traffic inspection. ModSecurity has now a standalone module (API) for external code integration.</div>
<div style><br></div><div style>If you guys are interested, let's talk about how we can move forward.</div><div style><br></div><div style>Thanks</div><div style><br></div><div style>Breno</div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Thu, Jul 4, 2013 at 4:31 PM, Kevin Ross <span dir="ltr"><<a href="mailto:kevross33@googlemail.com" target="_blank">kevross33@googlemail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>Yup it does. If it was integrated where Suricata is basically passing off the requests and responses to modsecurity then the benefits would be great. We would have much better detection of inbound web attacks and all the benefits of modsecurity as it is developed would be of benefit if Suricata could get the web traffic to it. Another interesting thing with modsecurity is bayesian analysis <a href="http://blog.spiderlabs.com/2012/09/web-application-defense-bayesian-attack-analysis.html" target="_blank">http://blog.spiderlabs.com/2012/09/web-application-defense-bayesian-attack-analysis.html</a><br>
<br></div><div>Also it would be of benefit because there is a lot of people who can't directly mess with the servers to do modsecurity and reverse proxying isn't an option either. Being able to have it inline or out of line would be cool. Out of line is also great for tuning and stuff and I know it works; Trustwave's web defend can be deployed out of line which is good to get things right until you are comfortable enough to go inline (and it is a great WAF if anyone is looking at the options).<br>
<br></div><div>People could maybe even use the auditconsole with it for viewing alerts from modsecurity <a href="http://www.jwall.org/web/audit/console/screenshots/index.jsp" target="_blank">http://www.jwall.org/web/audit/console/screenshots/index.jsp</a>.<br>
<br></div><div>Regards,<br>Kevin<br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 4 July 2013 10:10, Victor Julien <span dir="ltr"><<a href="mailto:lists@inliniac.net" target="_blank">lists@inliniac.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On 07/04/2013 09:26 AM, Kevin Ross wrote:<br>
> Well that is dissapointing. Perhaps the solution is having Suricata or<br>
> BRO being able to pass traffic into modsecurity with the ability to<br>
> define which websites (HTTP and HTTPS with certs) is passed in?<br>
> Hopefully getting the benefits of modsecurity without having to worry<br>
> about fully intergrating individual detections such as libinjection and<br>
> other new or experimental things directly into Suricata/Bro.<br>
<br>
</div>ModSecurity actually also uses libinjection :)<br>
<br>
Cheers,<br>
Victor<br>
<br>
> On 3 July 2013 18:54, Seth Hall <<a href="mailto:seth@icir.org" target="_blank">seth@icir.org</a> <mailto:<a href="mailto:seth@icir.org" target="_blank">seth@icir.org</a>>><br>
<div>> wrote:<br>
><br>
><br>
> On Jul 2, 2013, at 2:18 AM, Peter Manev <<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a><br>
</div><div>> <mailto:<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>>> wrote:<br>
><br>
> > Yes it is considered -<br>
> > <a href="https://redmine.openinfosecfoundation.org/issues/547" target="_blank">https://redmine.openinfosecfoundation.org/issues/547</a><br>
><br>
><br>
> For the record, I just spent a few minutes and integrated this into<br>
> Bro and ran it on some real world traffic and this isn't good.<br>
> There are a lot of false positives. It's probably another one of<br>
> those things that tends to work fine if you run it on your own<br>
> server, but when you're watching general internet traffic it starts<br>
> showing some flaws.<br>
><br>
> .Seth<br>
><br>
> --<br>
> Seth Hall<br>
> International Computer Science Institute<br>
> (Bro) because everyone has a network<br>
> <a href="http://www.bro.org/" target="_blank">http://www.bro.org/</a><br>
><br>
><br>
><br>
><br>
</div><div>> _______________________________________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>
><br>
<br><span class="HOEnZb"><font color="#888888">
<br>
</font></span></div><span class="HOEnZb"><font color="#888888"><div>--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
</div><div><div>_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>
</div></div></font></span></blockquote></div><br></div>
<br>_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br></blockquote></div><br></div>