NIDS just got a lot easier

[Kinstonian]

SecurityOnion has been out for a while now, but it's about to get even easier:

http://www.youtube.com/watch?v=mazSRVFYmLQ

No sense in installing Snort to get alerts you can't do much with because of the lack of information, when you can just as easily install SecurityOnion and have the data you need to investigate the alerts.

[cprofitt]

Nice -- going to have to set that up soon.

[bodhi.zazen]

Nice video. I agree, would be nice to port the tools to rpm systems. IMO if you can package a .deb you can package a .rpm =)

[cryptotheslow]

Interesting presentation and certainly a useful amalgamation of tools. It seems very much aimed at securing/monitoring a corporate's network traffic. The casual dismissal of the cost of storing pcap data and spinning up endless snort instances is a little worrying, but I suppose it is not intended to scale up to say telco levels of traffic.