Hi Folks,
First time poster.

I am a network consultant and wish to provide my clients with an IDS
Solution. I have done some research and would like to know what method
should be used host-base IDS or a stand-alone server for the IDS
Solution or both.

This system should also update it's rules by itself, good reports to
show off to management and most important be easy to manage. I have
been looking at StillSecure and Snort but want to know what the
security experts think. My clients are also 25-150 users so the budget
should be under 8K.


thanks in advance.

Hi, 

Personally I'm a big fan of appliance over software systems. Keeping
the scans off the main server has advantages in performance and
security. Cisco's Secure IDS and ISS's RealSecure are rather  good at
this.

Here is a review of those systems
http://www.nwfusion.com/reviews/2000/1218rev2.html

An article
http://www.nwfusion.com/news/2002/0701ids.html

Unfortunately all of the systems have their problems, which brings me
back to Snort more often than not. Though it's not fancy looking and
the reports aren't as spiffy (is that a real word?) the detection is
probably the best out there at any cost and is constantly undated and
reviewed by SO's all over the world. With that type of security,
writing a few Perl scripts to make the reports look fancy is a small
price to pay.

Most of the time when a group of IDS packages are tested for a review,
SNORT is up there in the 1st or 2nd slot, much to the high price
systems chagrin. More often these days the higher priced appliances
are using the source code of SNORT in their software.

Just between you and me, the only time I don't use Snort with a client
is when the client can't get around the brand name, big company,
factor and just has to purchase something expensive to talk about at
the gold club. Then I get him the Cisco.

Links

http://www.mcpmag.com/Features/article.asp?EditorialsID=294 
Snort top, all others commended 
NetProwler 3.5.1 
RealSecure 6.5 
Dragon 5.0.2 
Snort 1.8.7b121 with Analysis Console for Intrusion Detection 0.96b21

http://www.nss.co.uk/ids/edition3/index.htm 
review without authored conclusion. RealSecure top for detection 
Cisco Secure IDS 4230 
ISS RealSecure 7.0 
Snort 1.8.6 
Entercept 2.5 
NFR HID 2.0 
Okena StormWatch 2.1 


http://osec.neohapsis.com/results/ 
pure testing results - no conclusions. 

ISS RealSecure 7.0 Last Revision: Aug. 23, 2002 
IntruVert Intrushield 0.97.12 Last Revision: Aug. 23, 2002 
Intrusion, Inc. Testing in progress. 
SourceFire Scheduling in progress. 
NFR Not Scheduled 
Cisco Systems Not Scheduled 
Enterasys Networks Not Scheduled 
OneSecure/Netscreen Not Scheduled 
Tippingpoint Not Scheduled 


http://www.networkcomputing.com/1307/1307f2.html 
review of IDS management tools 
netForensics netForensics 2.3 
GuardedNet neuSecure 1.5 
Intellitactics Network Security Manager 3.3 
e-Security e-Sentinel 3.1 
Enterasys Networks Dragon Squire 
IBM Corp. Tivoli Risk Manager 3.8 


Intrusion Detection FAQ
http://www.sans.org/newlook/resources/IDFAQ/ID_FAQ.htm

The integrity checker tools include tripwire
ftp://coast.cs.purdue.edu/pub/tools/unix

Snort (Probably the best system out there at any cost)
http://www.snort.org/

SecureHQ - INtruson Detection Reviews
https://www.securehq.com/shqreview.wml&sessionid=200211323492516678&superdeptid=10

Test Centre prod 1
http://www.scmagazine.com/scmagazine/2000_06/testc/prod1.html

Intrusion Detection products grow up
http://www.nwfusion.com/reviews/2001/1008rev.html

Intrusion Detection Software (IDS) Product Comparisons
http://www.esecuredb.us/dscgi/ds.py/View/Collection-612



Query's
IDS +security Intrusion detection system
IDS security intrusion detection +reviews 
Cisco Secure IDS and ISS's RealSecure
SNORT IDS +Review +2002

thanks, 

webadept-ga

---

Request for Answer Clarification by npriority-ga on 22 Dec 2002 01:23 PST

Can someone post me any websites on how the GUI interface looks like with snort?

Thanks,
chris

---

Clarification of Answer by webadept-ga on 22 Dec 2002 12:00 PST

Hi, 

Snort itself doesn't have a GUI, but there is one called Razor Back
which you can see here.

http://www.intersectalliance.com/projects/RazorBack/index.html

Thanks WEBADEPT this is a good head start in the right direction. For
gui I found IDS Center. I don't know if you came across that one
before.

under that budget, something like snort, tripwire and some scripting
will do the work.
for a full flaged N & HIDS I advise Dragon, from enterays.
Nice, simple, performante, unix based, scriptable, updatable
(console), export data in various formats, nice interface, building
and importing signatures , the works.