<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
</head><body><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">Hi Charles </p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">We have done a fair amount of work on getting various Cloud setups to work. There are a number of factors that you will need to consider. Here is a general list based on my experience.</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">Is it private cloud or public cloud?</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">Is it all new setup or are you looking to integrate with an existing one?</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">If existing, what is currently in place?</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">Is it a single host or multiple hosts?</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">What sort of OSs and Apps are/will you be running? Our preference for new setups remains Ubuntu and AWS serves up all flavors of it.</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">Do you want to do IDS or IPS?</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">Do you want real time IDS or shift the files someone else for later analysis?</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">Once you have the answers to all those questions, you should be able to determine whether to run Suricata to monitor Virtual Switch, on the host itself, on an other Cloud server, in IDS mode or in IPS mode and so on.</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">Here is a link to a case study that might be of interest/help.</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;"><a href="http://countersnipe.com/images/countersnipe/AWS-Countersnipe-IDS-IPS-Case-Study.pdf">http://countersnipe.com/images/countersnipe/AWS-Countersnipe-IDS-IPS-Case-Study.pdf</a> </p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">Best</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">Amar</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;"><br></p><blockquote type="cite">On March 27, 2018 at 8:50 PM Charles Devoe <Charles.Devoe@cisecurity.org> wrote: <br> <br><div class="ox-736b5a947f-ox-8f2b660ae1-WordSection1"><p class="ox-736b5a947f-ox-8f2b660ae1-MsoNormal">I am looking or any Information on running Suricata in the Cloud. I know Michal Purzynski presented on this at Surion 2017. If I could get a link to his slides or the paper that would be really helpful. </p></div>This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments. <br> <br>. . . . .</blockquote><p style="font-size:12pt;font-family:arial, helvetica, sans-serif;color:#000080;" class="default-style"><br> </p><blockquote type="cite">_______________________________________________ <br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org <br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/ <br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users <br> <br>Conference: https://suricon.net <br>Trainings: https://suricata-ids.org/training/</blockquote><p style="font-size:12pt;font-family:arial, helvetica, sans-serif;color:#000080;" class="default-style"><br> </p></body></html>