MONITORING TOOLS Open Source Security Tools to monitor your network

DEFINITION Monitoring is defined as "observing and analyzing the status and behavior of the network, which involves end systems, intermediate systems and the core network. By monitoring a network the management entity can get the static, dynamic and statistical information of the network."

NAGIOS WHY? Offers monitoring and alerting capability for servers, switches, applications, and services Offers monitoring and alerting capability for servers, switches, applications, and services Very flexible in integrating with other third party programs Very flexible in integrating with other third party programs Many free plugins already developed by companies Many free plugins already developed by companiesplugins

NAGIOS REALLY A SECURITY TOOL? Can be compared as a policemen who does round-the-clock patrols “ISPs claim heightened awareness and vigorous monitoring have helped reduce damage”

NAGIOS ADD-ONS Other projects extend the core functionality provided with a basic Nagios install NSTI + SNMPTT - For managing SNMP traps and receiving alerts NSTI + SNMPTT - For managing SNMP traps and receiving alerts NSTISNMPTT NSTISNMPTT NagVis - A visualization program that can be used to visualize data NagVis - A visualization program that can be used to visualize data NagVis NagiosQL - A web based administration tool that helps you to easily build, manage, and use a complex configuration with all options enabled NagiosQL - A web based administration tool that helps you to easily build, manage, and use a complex configuration with all options enabled NagiosQL BPI - An advanced grouping tool that allows you to define more complex dependencies for determining groups states BPI - An advanced grouping tool that allows you to define more complex dependencies for determining groups states BPI

CACTI WHY? Provides performance measurement and advanced data acquisition methods Provides performance measurement and advanced data acquisition methods Many flexible graph templates already available Many flexible graph templates already available Keeps historical data collection for a long period of time Keeps historical data collection for a long period of time Little overhead and keeps storage requirements extremely low Little overhead and keeps storage requirements extremely low

CACTI ADD-ONS Other plugins extend the core functionality provided by a basic Cacti installation Other plugins extend the core functionality provided by a basic Cacti installation Thold - A threshold Alert Module Thold - A threshold Alert Module Thold Nectar - Plugin to send Graphs and Text to specified mail address(es) Nectar - Plugin to send Graphs and Text to specified mail address(es) Nectar Discovery - Adds auto host discovery to the software Discovery - Adds auto host discovery to the software Discovery Cycle - Automatically cycles through graphs Cycle - Automatically cycles through graphs Cycle Boost - A large Site Performance Booster Boost - A large Site Performance Booster Boost

SNORT WHY? Offers a network intrusion prevention and detection system (IDS/IPS) Offers a network intrusion prevention and detection system (IDS/IPS) The most widely deployed IDS/IPS technology worldwide The most widely deployed IDS/IPS technology worldwide Perfect for quickly writing simple and powerful new rules Perfect for quickly writing simple and powerful new rules The de facto standard for IPS The de facto standard for IPS

SNORT DEPLOYMENT SCENARIO 1

SNORT DEPLOYMENT SCENARIO 2

SNORT ADD-ONS Other projects extend the core functionality provided by a basic Snort install Other projects extend the core functionality provided by a basic Snort install Snorby - A new and modern Snort IDS front-end Snorby - A new and modern Snort IDS front-end Snorby Barnyard2 - A dedicated spooler for Snort's unified2 binary output format Barnyard2 - A dedicated spooler for Snort's unified2 binary output format Barnyard2 Pulled_Pork - Perl script that automatically updates Snort rules Pulled_Pork - Perl script that automatically updates Snort rules Pulled_Pork bProbe - A Snort IDS configured to run in packet logger mode bProbe - A Snort IDS configured to run in packet logger mode bProbe

LOGSTASH WHY? Offers logs/event transport, processing, management, and search Offers logs/event transport, processing, management, and search Very fast search results even on a billion logs (elasticsearch) Very fast search results even on a billion logs (elasticsearch) Can produce multiple personalized dashboards Can produce multiple personalized dashboards Can easily parse text-based logs Can easily parse text-based logs

LOGSTASH ADD-ONS Other projects extend the core functionality provided by a basic Logstash install Other projects extend the core functionality provided by a basic Logstash install Elasticsearch – A distributed, RESTful, Real time analytics and search engine Elasticsearch – A distributed, RESTful, Real time analytics and search engine ElasticsearchRESTful ElasticsearchRESTful Kibana - The visual front end for Logstash & Elasticsearch Kibana - The visual front end for Logstash & Elasticsearch Kibana RabbitMQ – An Advanced Message Queuing Protocol RabbitMQ – An Advanced Message Queuing Protocol RabbitMQ

NTOP WHY? Shows traffic measurement, characterization and network usage in a real time Shows traffic measurement, characterization and network usage in a real time Monitor high speeds (1 Gbit and above) with common PCs Monitor high speeds (1 Gbit and above) with common PCs Detection of network security violations Detection of network security violations Work with NetFlow & sFlow protocols Work with NetFlow & sFlow protocolsNetFlowsFlowNetFlowsFlow

NTOP DEPLOYMENT SCENARIO 1

NTOP DEPLOYMENT SCENARIO 2

NTOP DEPLOYMENT SCENARIO 3

NTOP ADD-ONS Other projects extend the core functionality provided by a basic Ntop install. Other projects extend the core functionality provided by a basic Ntop install. Packet Filter Ring (PF_RING) - High-speed packet capture, filtering and analysis Packet Filter Ring (PF_RING) - High-speed packet capture, filtering and analysisPF_RING nProbe - An Extensible NetFlow v5/v9/IPFIX Probe for IPv4/v6 nProbe - An Extensible NetFlow v5/v9/IPFIX Probe for IPv4/v6 nProbe

PRIVAL & BLESK WHY? Provides advanced technologies and solutions to its customers Provides advanced technologies and solutions to its customers Blesk represents ten years of development & knowledge in Open Source Blesk represents ten years of development & knowledge in Open Source Resources to help you implement open source monitoring technologies in your enterprise Resources to help you implement open source monitoring technologies in your enterprise Provides support and updates of all open source monitoring components Provides support and updates of all open source monitoring components Customize and Improve open source technologies for your needs Customize and Improve open source technologies for your needs