We have gone through many of the available open source tools out there, and from what we have seen there are only a few good ones worth mentioning. I will list these from best to worst as to make this easy.
1. Suricata: This is essentially an upgraded version of Snort, but it is much more powerful. When setup on a computer or server Suricata is capable of both detecting threats and blocking them. When going through Open Source Intrusion Detection Software out there, this was our number one tool for detecting threats. Be warned though, the setup for Suricata is a lot of work. Find out more about Suricata here: https://suricata.io/
2. Wazuh: Now this is an amazing platform. Wazuh allows you to take logs straight from endpoints that are running Snort or Suricata and parse them in an easy to read way. It has a dashboard which makes viewing alert data fairly easy as well. Wazuh is definitely something that will take time to setup, but it should be no harder to setup than Suricata. The best way to setup Wazuh is through the cloud with 3 separate Linux servers. This way it should be fairly easy for Wazuh to digest logs from any other area. The Wazuh installation can be tough so let us know if you would like us to create an in-depth tutorial for this. For now though you can read about Wazuh here: https://wazuh.com/
3. CheckMK: This was probably one of the first open source systems we checked out. With CheckMK you have the ability to monitor security events through alerts that is similar to Wazuh in the way that it can present some information from alerts. That said the more we looked at it the more we realized that the free version of CheckMK is limited. It is limited in its ability to monitor when comparing Suricata and the dashboard is not that great looking. The worst part is probably that it is more difficult to setup when compared to Suricata and Wazuh. If you wish to give it a try as it does offer some unique options then check it out here: https://checkmk.com/
4. Zeek: The cool thing about Zeek is that like CheckMK it does not require two separate installations like with Suricata and Wazuh. It also has a dashboard that looks a little similar to Wazuh. That said it can be challenging to setup without a proper tutorial. We tried setting it up ourselves as it was probably our second pick for an Open Source IDS, but for us we could not get it to take in alerts the way we wanted. The problem with Zeek, CheckMK, and some others that we tried is that they are just too complicated to setup with fairly low levels of free support documentation. Now that said you can find tutorials for any of these with enough effort, but what I am gauging is the level of effort that each takes.
These are the main Open Source Intrusion Detection Software that we tried with each having some small benefits over the other. Looking at all of the possibilities though, I think it is very clear that Suricata combined with Wazuh is the best Open Source IDS setup. The main benefit with Wazuh and Suricata is that there are so many tutorials out there that explain how to set these up. In fact we have perfected the process ourselves and in the future we may release some content outlining exactly how you would go about setting it up. Go ahead and reach out to us on the contact page if you have something you would like to share with us. We can also help you with your Cyber Security.
