CustomOS3.1 OBSIDIAN
Network IDS
Installed by default in pure IDS mode: Suricata clones traffic and never decides a packet's fate.
Mode
IDS (af-packet)
copy-mode none · detection only
Rules
5 local
sid 1000001–1000005
ET-open
Not downloaded
opt-in: customos-nids rules update
| Local rule | Detects |
|---|---|
| 1000001 | DNS to an unauthorized resolver |
| 1000002 | Cleartext FTP credentials |
| 1000003 | HTTP Basic Auth in cleartext |
| 1000004 | Outbound Telnet session |
| 1000005 | Large ICMP payload (possible tunnel / C2) |
customos-nids mode ips [--fail-open|--fail-closed]
inline blocking via NFQUEUEcustomos-nids correlate --since 1h
joins Suricata, auditd and AIDE eventsdetection is post-hoc unless you opt in to IPS