Security / Threat Intel Question

Follow

Joe

• September 03, 2021 18:09

I am interested in learning more about how firewalla works. Do you have a whitepaper explaining what open source tools are used and where you get your threat intelligence?

Specifically:

what is used for IPS? Snort, Surricata, Bro? Is SSL decryption an option?

what definitions are used for both block lists and definition lists? Do these come from Emerging Threats repo / what sources?

Thank you!

1

• 

  Firewalla

  • September 03, 2021 18:14

  If you have a unit, you can actually go inside and look.  

  IDS (and a little bit of IPS) is Bro/Zeek, and IPS is our own homegrown 

  No SSL decryption.

  We use a combination of static and dynamically generated lists, mostly paid (licensed), and we are starting to use some of the public lists. 

  1

  Comment actions Permalink
• 

  Kam Merryman

  • November 18, 2022 01:22

  Where/how would I go about looking to see what sort of attacks would be prevented by the homegrown IPS?  

   

  0

  Comment actions Permalink

Please sign in to leave a comment.