<div dir="ltr">Hi Coop,<div><br></div><div>Thanks for the input.</div><div>Yeah, I have been playing around with it in a VM only on my desktop.</div><div>My only disappointment was the MLE part of it. It is not what is advertise in OPNids project, it is basically just Suricata on an iso with couple other services, as I mentioned earlier.</div><div>They are using DragonFly MLE which in itself is an open source project which can be anyways integrated to any NSM that produces json logs. And OPNids DOES NOT include it.</div><div>MLE has to be downladed and installed manually on that iso, which forfeits the purpose.</div><div><br></div><div>We had migrated from using snort to suricata in production last year, and have been using it fine.</div><div>Just wanted to experiment with the Machine Learning with Suricata alerts.</div><div><br></div><div>Thanks,</div><div>Fatema.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Mar 26, 2019 at 3:31 PM Nelson, Cooper <<a href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-6956969701054819318WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Ok, I just figured out that this is built on top of OPNsense, which I have been meaning to experiment with.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I would personally just grab the iso, follow the instructions here and run it in a tiny VM. I could run this on my laptop easily.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><a href="https://www.opnids.io/get-started-guide" target="_blank">https://www.opnids.io/get-started-guide</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">You could also just build this in a cloud service or hosted VM environment. No need to bother with a bootable USB unless you have to.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">-Coop<span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Oisf-users <<a href="mailto:oisf-users-bounces@lists.openinfosecfoundation.org" target="_blank">oisf-users-bounces@lists.openinfosecfoundation.org</a>>
<b>On Behalf Of </b>Nelson, Cooper<br>
<b>Sent:</b> Tuesday, March 26, 2019 12:24 PM<br>
<b>To:</b> fatema bannatwala <<a href="mailto:fatema.bannatwala@gmail.com" target="_blank">fatema.bannatwala@gmail.com</a>>; Open Information Security Foundation <<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>><br>
<b>Subject:</b> Re: [Oisf-users] OPNids - Any thoughts?<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I’ve been doing NIDS deployments (bro/snort) for about fifteen years and HPC suricata deployments of the last five. I also studied expert systems and machine
learning in an academic environment about 25 years ago, so I’m familiar with the basics.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">That said, there is a steep learning curve here and I’m not currently sure how we could make use of it in its current format (DVD ISO builds). This would be
fine for a small network or ‘greenfield’ deployment I think.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I would personally recommend starting with something like Security Onion and learning the basics of suricata (and getting familiar with it), before trying this
distro. I know it took me at least a year to get comfortable with suricata and I’m still learning stuff on a daily/weekly basis.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">If someone could put together a docker build that could integrate with our existing suricata sensor I would be happy to try it out.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">-Coop<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Oisf-users <<a href="mailto:oisf-users-bounces@lists.openinfosecfoundation.org" target="_blank">oisf-users-bounces@lists.openinfosecfoundation.org</a>>
<b>On Behalf Of </b>fatema bannatwala<br>
<b>Sent:</b> Monday, March 25, 2019 1:41 PM<br>
<b>To:</b> Open Information Security Foundation <<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>><br>
<b>Subject:</b> [Oisf-users] OPNids - Any thoughts?<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hi,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">So recently I was reading about the OPNids project and thought to give it a try it.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">And as a new user complaining, had few unclear thoughts that I thought to share with the list.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">First of, the documentation is little hard to decode, and was having trouble in installing OPNids with USB stick. But finally tried the virtual installation with the iso and it installed correctly.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">The web GUI is good with all the nods and buttons, and user friendly options.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">After reading so much about the "OPNids being the first integration of Suricata Signature Inspection with a Machine Learning Scripting Engine (MLE)" I though it already comes with MLE installed and integrated with Suricata in the installation
package, which comes with the pre-build OS (FreeBSD) with other pre-installed services. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">But unfortunately it does not. DragonFly MLE has to be manually installed on the OPNids system and proper configuration is needed to integrate it with Suricata, which makes me think that then how it is different than the situation of just
having Suricata installed on one of the servers with OS of our choice, and then installing MLE on the same server integrating it with Suri and using it for ML analysis? <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">It was a little disappointment to know that apparently OPNids is nothing but Suricata with couple other services installed on a box, EXCEPT MLE... Hmm kinda sad.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">And also, if someone has tried to ply around with it and would like to share experience/thoughts?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Fatema.<u></u><u></u></p>
</div>
</div>
</div>
</div>
</blockquote></div>