|
Sourcefire Rolls Out Open-Source 'Razorback' |
|
|
|
Source: Dark Reading - Posted by Anthony Pell
|
The makers of the popular open-source Snort intrusion detection platform today unveiled a new open-source platform -- a detection framework that unites existing security tools, including IDS/IPSes.
The new Razorback platform developed by Sourcefire is basically a tool for tying together the various layers of detection within an organization, including antivirus, IDS/IPS, Web and email gateways, and firewalls, to use in concert to catch and examine potential threats and create mitigations on the fly. Its creators say it's not the same thing as a security information management tool, however, because it does more than capture events: "SIM collects events in a vacuum: It takes an AV event and says this host is infected by a virus ... It doesn't know anything about that piece of malware on the box," says Matt Watchinski, senior director of Sourcefire's vulnerability research team.
Razorback, however, uses the various tools to provide more context about a potential attack, he says. It handles detection in near real-time and can convert newly found intelligence on an attack into a detection mechanism for it. It's basically a framework that overlays the existing security infrastructure and lets the various tools work more in concert, according to Sourcefire.
Read this full article at Dark Reading
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
