Messages

1

Intrusion Detection and Prevention / Re: IDS on traffic passing through web proxy

« on: May 14, 2024, 11:10:35 am »

Thank you for your response. Currently, we're utilizing the first greenleafguru option you provided. We've established our Certificate Authority (CA) for the MITM Proxy, and it's functioning well with our clients and our specific use case, which is satisfactory for us. However, we're encountering an issue with herbalhighsociety the Intrusion Detection System (IDS) / Intrusion Prevention System (IPS). We're unsure of the steps needed to enable the IDS/IPS to scan the decrypted HTTPS traffic. Any guidance on this matter would be greatly appreciated.

2

Intrusion Detection and Prevention / Re: Suricata cutting download speed if IPS enabled

« on: April 23, 2024, 12:35:58 pm »

Yes, that's the typical behavior, where there's a significant performance penalty from IPS. This is more pronounced with CPUs that have lower single-thread performance.

3

Intrusion Detection and Prevention / Re: Suricata blocking Microsoft Teams

« on: April 06, 2024, 11:58:34 am »

I frequently utilize MS Teams without encountering any problems. If you're experiencing issues due to emerging-chat rules, consider disabling them. Alternatively, you can plnkgame individually deactivate the specific rules causing the blockage. Troubleshooting would entail monitoring alerts to pinpoint which rules are causing the traffic obstruction.