Introducing FIDO: Automated Security Incident Response

Re:Introducing FIDO: Automated Security Incident Response by obituary_latte on Monday May 04, 2015 @05:23PM (#9489299)

Is this intended to compliment or replace things like alienvault/snort? Can it handle raw nix logs? Logstash? Windows events? It seems like from the post some kind of third party connection is required (LANDesk?), but I may not be reading right.

At any rate, thanks as always for sharing :)

[ Parent | on HN ]

Re:Introducing FIDO: Automated Security Incident Response by freehunter on Monday May 04, 2015 @05:33PM (#9489364)

It doesn't seem like it replaces Snort, which is an intrusion prevention system. It's more akin to AlienVault, which is a SIEM. Netflix shies away from the term SIEM. They call this an incident response software. I'm reading through it trying to figure out how it's different from a SIEM, but there's not a lot of technical details.

[ Parent | on HN ]

Re:Introducing FIDO: Automated Security Incident Response by thieving_magpie on Monday May 04, 2015 @07:24PM (#9489898)

So akin to snorby mixed with Ossec active-response? Should be interesting to see if this gets picked up in an OS like Security Onion.

Also, it appears to use snort.

[ Parent | on HN ]