Honeypots mailing list archives
Re: Alerting
From: "George Chamales" <george () overt org>
Date: Mon, 31 Mar 2003 17:29:56 -0600 (CST)
Richard, We're currently using swatch to email out alerts based on outbound connections/rate-limiting events seen from the firewall. Syslog-ng is being used to ferry them from the data-control machine to our logging host. Our config scripts are posted at: http://honeynet.overt.org/index.php/Network-Based%20Monitoring These are for swatch version 3.0.4 although looking at http://swatch.sourceforge.net there appears to be a new version. Best of luck, george
Current thread:
- Re: Alerting George Chamales (Mar 31)