Question

1. Explain what port Mirroring is and why it was necessary to enable this for Intrusion Detection. What component of an IDS system could have taken this step's place?

2. What is the purpose of SGUIL on the Security Onion system?

Answer 1

ANS :-

1. PART-1 :- Port mirroring is normally used for monitoring network traffic which is used basically on network switch to send copy of network packets seen in network switch port. It is actually observing and catching of network packets.

It is necessary to enable Port Mirroring for Intrusion Detection because Intrusion Detection is a major network trafficking which can cause loss for a company and also data breaches and can harm customer trust.

Part -2:- The component of an IDS system could have taken this steps place are :-

• Sensors - Intrusion Detection is triggered as it is used to generate security events.
• Console - It is used to monitor events and alerts and also controls console.
• Engine - It generates alerts for the security events detected by Intrusion Detection and formed by creating database in sensors by particular rules.

2. SGUIL is an implementation of Network Security monitoring system. The purpose of SGUIL on the security Onion system are :-

• It works as network security analyst as it forms a network security analyst.
• It provides access to real time events by the component intuitive GUI.
• It also captures raw packets and session data.
• It facilitates event driving analysis.