Network detection tools utilize one of two prominent approaches for threat detection: AI-driven behavior-based methods capable of identifying early indicators of compromise, and signature-based ones, which flag known attacks and common CVEs. While these systems operate on distinct principles, their combination forms more robust defense mechanism, helps to consolidate tools, provides richer threat context and improves compliance.

In this article, we explained the benefits of combining signature-based detection by Suricata IDS with behavior-based detection by Flowmon ADS. Now, let’s talk about how to enable this feature using Flowmon Probe and Flowmon ADS.

From DX UIM 20.4 CU4 onward (that is, releases that have robot version 9.36 or above), robots automatically support Linux versions with newer GNU C Library (commonly known as “glibc”) versions. Prior to CU4, DX UIM robots needed certification and a release to provide support or compatibility with newer Linux operating systems that have a higher glibc version.

A firewall stands as a digital gatekeeper, meticulously sifting through network traffic and deciding what may pass. This protective shield, fundamental to cybersecurity, is integral in the Linux world. The Linux kernel itself is effectively a de facto packet switching firewall, crafted as it is around the principles of packet filtering at the most fundamental operating system level, thus exemplifying the pivotal role of firewalls in system security.