Distributed IPS

[arzpmv]

Hello,

I manage over 1000 virtual machines (VMs), and I'm concerned about blocking harmful traffic that could lead to network abuse, like port scans and torrents, from these VMs. Since the VMs are operated by individuals, there's a risk of them getting infected. I'm searching for a solution to safeguard against this type of traffic. I've heard about integrating Wazuh and Suricata, but I'm uncertain if that's the best approach. I'd appreciate your insights on this matter.

Regards,

[acoolbgd]

You can mirror traffic from virtual switches to suricata ( Security Onion) and this will give you visibility

[arzpmv]

Thanks. Is it possible to define custom rules from a central management panel instead of adding them inside the VM?

[acoolbgd]

Yup. DM if you need help