<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI Light";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.personapanelauncher
{mso-style-name:personapanelauncher;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Ray,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Apologies for the delay, I’m recovering from a chronic health issue and been meaning to send you a response.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">First of all, this is *<b>exactly</b>* what I’ve been looking for some time, I was even working on something similar on Linux and hoping to have something to
present at the last SuriCon. Unfortunately some high-profile engagements got in the way of that.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Anyway, I’m very eager to try your stuff out and have a very specific technical question that I’ve been struggling with on the linux side of things. I’ll reach
out off-list to discuss.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Please keep us updated, this is a very exciting project for my particular research interests.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">-Coop<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org>
<b>On Behalf Of </b>Ray Schneider<br>
<b>Sent:</b> Friday, March 29, 2019 6:12 AM<br>
<b>To:</b> oisf-users@lists.openinfosecfoundation.org<br>
<b>Subject:</b> [Oisf-users] Response to -> OPNids - Any thoughts? thread<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div id="divtagdefaultwrapper">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div id="Item.MessagePartBody">
<div id="Item.MessageUniqueBody">
<div>
<div>
<div id="x_divtagdefaultwrapper">
<p><span style="font-family:"Calibri",sans-serif;color:black">Hello OISF-Users,<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">This post is a response from the OPNids team to the thread referenced in the subject line.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">First, we would like to thank everyone and anyone on this list that has expressed an interest in OPNids and downloaded it to give it a try and experiment with the DragonFly Machine Learning Engine
that is included in the OPNids install. They are separate open source projects available at the links included at the bottom of the message.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">The project would like to clear up what appears to be a misunderstanding. The DragonFly-MLE is included in the OPNids images that are currently available at the mirrors of the project. It does not
however run in a container inside those images since they are FreeBSD based living on top of the OPNsense ecosystem.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">The MLE is not enabled by default, this must be done post install via the web gui. This is because the project had decided that the end user should enabled it if it is desired since you need to write/configure
analyzers for it in order to get any value. The first release of OPNids had a goal of enablement, meaning we wanted to enable the community to write analyzers and using the Dragonfly Machine Learning Engine on the system, perform machine learning activities
in coordination with Suricata (also included in OPNids).<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">We are planning a new release in the coming weeks (with many more provided image options beyond the 2 available today). There are a lot of updates coming. I hope you all will join us and provide
constructive feedback and participation if you are so inclined. We are still a new project, although much of what we are stands on the shoulders of the Suricata project and the OPNsense project to be sure. <o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">Thanks for reading this long response. We hope it clears up some of the confusion.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">The OPNids Project<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><a href="https://github.com/opnids" target="_blank" id="LPlnk44809"><span style="font-family:"Calibri",sans-serif">https://github.com/opnids</span></a><span style="font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
<div style="margin-bottom:15.0pt;overflow:auto" id="LPBorder_GT_15538033459890.5266084021751707">
<table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="0" style="width:512.25pt;border-top:dotted #C8C8C8 1.0pt;border-left:none;border-bottom:dotted #C8C8C8 1.0pt;border-right:none">
<tbody>
<tr>
<td width="271" valign="top" style="width:187.5pt;border:none;padding:15.0pt 15.0pt 15.0pt .75pt">
<div style="margin-top:5.0pt;margin-bottom:5.0pt;display:table" id="LPImageContainer_15538033459860.5383155787872034">
<p class="MsoNormal" style="margin-top:15.0pt"><a href="https://github.com/opnids" target="_blank"><span style="text-decoration:none"><img border="0" width="250" height="250" style="width:2.6041in;height:2.6041in" id="_x0000_i1028" src="https://avatars2.githubusercontent.com/u/37083840?s=280&v=4" alt="https://avatars2.githubusercontent.com/u/37083840?s=280&v=4"></span></a><o:p></o:p></p>
</div>
</td>
<td valign="top" style="border:none;padding:0in 0in 0in 0in" id="x_x_TextCell_15538033459870.05340804220705442">
<div id="LPTitle_15538033459870.8839833313747412">
<p class="MsoNormal" style="margin-top:15.0pt;line-height:15.75pt"><a href="https://github.com/opnids" target="_blank"><span style="font-size:16.0pt;font-family:"Segoe UI Light",sans-serif">OPNids · GitHub</span></a><span style="font-size:16.0pt;font-family:"Segoe UI Light",sans-serif;color:#0078D7"><o:p></o:p></span></p>
</div>
<div style="margin-top:7.5pt;margin-bottom:12.0pt" id="LPMetadata_15538033459880.06474108725807382">
<p class="MsoNormal" style="margin-top:15.0pt;line-height:10.5pt"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#666666">github.com<o:p></o:p></span></p>
</div>
<div id="LPDescription_15538033459890.8859782939511367">
<p class="MsoNormal" style="margin-top:15.0pt;line-height:15.0pt"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#666666">OPNids has 8 repositories available. Follow their code on GitHub.<o:p></o:p></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><a href="https://github.com/counterflow-ai/dragonfly-mle" target="_blank" id="LPlnk507018"><span style="font-family:"Calibri",sans-serif">https://github.com/counterflow-ai/dragonfly-mle</span></a><span style="font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
<div style="margin-bottom:15.0pt;overflow:auto" id="LPBorder_GT_15538033629900.29200806063215756">
<table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="0" style="width:512.25pt;border-top:dotted #C8C8C8 1.0pt;border-left:none;border-bottom:dotted #C8C8C8 1.0pt;border-right:none">
<tbody>
<tr>
<td width="271" valign="top" style="width:187.5pt;border:none;padding:15.0pt 15.0pt 15.0pt .75pt">
<div style="margin-top:5.0pt;margin-bottom:5.0pt;display:table" id="LPImageContainer_15538033629880.8806058229972207">
<p class="MsoNormal" style="margin-top:15.0pt"><a href="https://github.com/counterflow-ai/dragonfly-mle" target="_blank"><span style="text-decoration:none"><img border="0" width="250" height="250" style="width:2.6041in;height:2.6041in" id="_x0000_i1027" src="https://avatars2.githubusercontent.com/u/33465431?s=400&v=4" alt="https://avatars2.githubusercontent.com/u/33465431?s=400&v=4"></span></a><o:p></o:p></p>
</div>
</td>
<td valign="top" style="border:none;padding:0in 0in 0in 0in" id="x_x_TextCell_15538033629880.13809054568693258">
<div id="LPTitle_15538033629880.9813876710577294">
<p class="MsoNormal" style="margin-top:15.0pt;line-height:15.75pt"><a href="https://github.com/counterflow-ai/dragonfly-mle" target="_blank"><span style="font-size:16.0pt;font-family:"Segoe UI Light",sans-serif">GitHub - counterflow-ai/dragonfly-mle: DragonFly:
Streaming Machine Learning Engine (MLE) for Network Threat Detection</span></a><span style="font-size:16.0pt;font-family:"Segoe UI Light",sans-serif;color:#0078D7"><o:p></o:p></span></p>
</div>
<div style="margin-top:7.5pt;margin-bottom:12.0pt" id="LPMetadata_15538033629890.8661636014774792">
<p class="MsoNormal" style="margin-top:15.0pt;line-height:10.5pt"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#666666">github.com<o:p></o:p></span></p>
</div>
<div id="LPDescription_15538033629900.6883455075461267">
<p class="MsoNormal" style="margin-top:15.0pt;line-height:15.0pt"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#666666">QUICK START. Using Docker, this example assumes there is an instance of Suricata already installed and running on
the host and it is logging to eve.json in directory /var/log/suricata/log.<o:p></o:p></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal"><a href="https://opnids.io/" target="_blank" id="LPlnk328686"><span style="font-family:"Calibri",sans-serif">https://opnids.io</span></a><span style="font-family:"Calibri",sans-serif;color:black">
<o:p></o:p></span></p>
<div style="margin-bottom:15.0pt;overflow:auto" id="LPBorder_GT_15538035498090.7082216021151664">
<table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="0" style="width:512.25pt;border-top:dotted #C8C8C8 1.0pt;border-left:none;border-bottom:dotted #C8C8C8 1.0pt;border-right:none">
<tbody>
<tr>
<td width="271" valign="top" style="width:187.5pt;border:none;padding:15.0pt 15.0pt 15.0pt .75pt">
<div style="margin-top:5.0pt;margin-bottom:5.0pt;display:table" id="LPImageContainer_15538035498070.8803788400942067">
<p class="MsoNormal" style="margin-top:15.0pt"><a href="https://opnids.io/" target="_blank"><span style="text-decoration:none"><img border="0" width="250" height="63" style="width:2.6041in;height:.6562in" id="_x0000_i1026" src="http://static1.squarespace.com/static/5b1923fce749409db5a6677b/t/5b4f4ac6575d1ff83c30d1ed/1531923151055/opnids-logo-light-bg.png?format=1500w" alt="http://static1.squarespace.com/static/5b1923fce749409db5a6677b/t/5b4f4ac6575d1ff83c30d1ed/1531923151055/opnids-logo-light-bg.png?format=1500w"></span></a><o:p></o:p></p>
</div>
</td>
<td valign="top" style="border:none;padding:0in 0in 0in 0in" id="x_x_TextCell_15538035498070.9054089344931873">
<div id="LPTitle_15538035498070.3464119426868262">
<p class="MsoNormal" style="margin-top:15.0pt;line-height:15.75pt"><a href="https://opnids.io/" target="_blank"><span style="font-size:16.0pt;font-family:"Segoe UI Light",sans-serif">OPNids</span></a><span style="font-size:16.0pt;font-family:"Segoe UI Light",sans-serif;color:#0078D7"><o:p></o:p></span></p>
</div>
<div style="margin-top:7.5pt;margin-bottom:12.0pt" id="LPMetadata_15538035498080.6296130918498273">
<p class="MsoNormal" style="margin-top:15.0pt;line-height:10.5pt"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#666666">opnids.io<o:p></o:p></span></p>
</div>
<div id="LPDescription_15538035498090.4446388791214173">
<p class="MsoNormal" style="margin-top:15.0pt;line-height:15.0pt"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#666666">The first integration of Suricata IDS with a purpose-built Machine Learning Scripting Engine. A pathway forward
for the Data Science Security Analyst to take advantage of today's mature and robust Suricata network detection engine while experimenting with machine learning threat models -- all bundled in a free, open <o:p></o:p></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-family:"Calibri",sans-serif;color:black">
<hr size="2" width="713" style="width:534.75pt" align="center">
</span></div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>