I have OSSEC installed on my hosts. I want to detect port scans and generate an alert in OSSEC. So, how can I detect these port scans?
Is it possible reading iptables logs? Do you recommend some specific tool as PSAD?.
Thanks.
I have OSSEC installed on my hosts. I want to detect port scans and generate an alert in OSSEC. So, how can I detect these port scans?
Is it possible reading iptables logs? Do you recommend some specific tool as PSAD?.
Thanks.
Log Monitoring
You could do it through log monitoring and trigger some alerts. Check out a commercial solution like Splunk. This allows you to manage and read your logs by creating dashboards, thresholds, and alerts.
Whenever you are being probed, you could pop an alert through log monitoring.
Soon enough you'll find yourself creating dashboards and alerts for all kinds of things!
Also check out GrayLog and ELK (ElasticSearch, Logstash, Kibana) which I believe are open-source and free.