IDS alert change #1971
-
|
Are you able to switch from Zeek to Suricata with reinstallation? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 2 replies
-
|
Zeek doesn't really generate IDS alerts the way that Suricata does. For more information about Zeek, please see: |
Beta Was this translation helpful? Give feedback.
-
|
I accidentally hit Zeek during installation, is there a way that I can switch to Suricata without redoing the whole installation? |
Beta Was this translation helpful? Give feedback.
-
|
If you are referring to the part of Setup where it asks you to choose between Zeek and Suricata, that is more to do with metadata logging rather than alerting. So if you chose Zeek there, you should still have Suricata generating IDS alerts. |
Beta Was this translation helpful? Give feedback.
Zeek doesn't really generate IDS alerts the way that Suricata does. For more information about Zeek, please see:
https://docs.securityonion.net/en/2.3/zeek.html