Dynamik anomalies and automated reaction

[ByteAndBits]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

128

RAM

1TB

Storage for /

60TB

Storage for /nsm

30TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Just two questions or feature request.

1. can SecOnion show dynamic anomalies:
   Example. One client allway conect to internal network and some Microsoft Servers during workhours. After 4 Month the client beginns to connect to domains in ohter countries at night.
   I there something like that? I know that this can work without big KI. PRTG has something like this ( Example: CPU for server allways on 10% after 3 month, the CPU goes to 90% for longer time).

2. Reaction of some events: Example: A clients opens a bit torrent to an external server -> automated Fireewall rule (on client or Firewall) to block this client or service.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.