Intrusion Detection.

[steve]

Hi guys.
I am preparing a University Thesis on the Network Monitoring and for this reason I am testing various products and Zabbix in partitcular.
I would like to know if Zabbix manages the problem of the Intrusion Detection. In particular I would like to know if Zabbix, through its agent, can detect a not authorized intrusion on a machine in the net that it is monitoring(and, as a conseguence, sending a notification to the network administrator) or if this task must be executed from other programs (like SNORT).
Thanks.

[amcorreia]

Hi guys.
I am preparing a University Thesis on the Network Monitoring and for this reason I am testing various products and Zabbix in partitcular.
I would like to know if Zabbix manages the problem of the Intrusion Detection. In particular I would like to know if Zabbix, through its agent, can detect a not authorized intrusion on a machine in the net that it is monitoring(and, as a conseguence, sending a notification to the network administrator) or if this task must be executed from other programs (like SNORT).
Thanks.

I supose this cannot do with zabbix.
You can do this with snort(NIDS) or prelude (NIDS and HIDS)
I guess both don't send native alerts.

[CJoshua]

Originally posted by snortuser
Can anyone help me with Intrusion Detection for my graduate's thesis project? I'm planning to illustrate how Snort may work with Zabbix and how these systems may help in the Security Alarm Systems at the university policy office, so I thought I could buy thesis materials and manuals online. Thanks.

I think you might look at REN-ISAC's workshops. Mike Lococo wrote a simple tutorial for learners: Monitoring Snort Performance with Zabbix on his personal website.

[KennethBass]

In particular I would like to know if Zabbix, through its agent, can detect a not authorized intrusion on a mcdvoice login machine in the net that it is monitoring and I guess both don't send native alerts. as a conseguence, sending a notification to the network administrator or if this task must be executed from other programs.