Re: Snort, ACID and portscan.log

[Christopher Cook <crcook () oakland edu>]

the alerts DO make it to the database.  But if you click on the IP 
address that gives you the portscan information, and then click 
"portscan events"  it wants a separate log file, it is unable to 
reference the file because the file is stored on the snort box itself. 
I have to physically copy the file (called portscan.log) which logs the 
actual events.  It has been suggested to change the output database to 
log, but then I'll lose the alerts.  Am I allowed to have one output do 
logs and another do alerts?

The reason for the question is that snort did come up with portscan 
events.  I went to click on the "portscan events" link and it came back 
with "cannot find $portscan_file" I went back to the snort box, 
transfered this one file, and it then worked, and I was able to put 
together that it was a portscan attack.  Though I don't want to have to 
copy this file everytime.  If snort can do it, cool.  If not, then I may 
have to set up a batch file to do it for me.

Chris Cook
Security and Support Specialist
Office of Information Technology
Oakland University

Dan Fiorito wrote:

> Your DB Output plugin should be changed to alert instead of log. Then it should work, do note that acid considers all 
> portscans as different alerts so if you are on a busy network you will have a lot of  alerts to sort through.
>
> 	-----Original Message----- 
> 	From: Christopher Cook [mailto:crcook () oakland edu] 
> 	Sent: Fri 8/9/2002 11:45 AM 
> 	To: snort-users () lists sourceforge net 
> 	Cc: 
> 	Subject: [Snort-users] Snort, ACID and portscan.log
>         
>         
>
>         I currently have Snort running on one box and doing all the spiffy mySQL
>         logging to another centrally located machine.  It's set to log alerts
>         and does that just fine.  Snort is set to log portscans and send them to
>         a portscan file locally to the snort box.  I didn't see any options in
>         Snort to send the portscan file to the remote log server so that ACID
>         can access it.  Is there a way to send the file to the remote log server
>         through Snort, or do I need to set a job to do it every night or so?
>         
>         Chris Cook
>         Security and Support Specialist
>         Office of Information Technology
>         Oakland University
>         
>         
>         
>         -------------------------------------------------------
>         This sf.net email is sponsored by:ThinkGeek
>         Welcome to geek heaven.
>         http://thinkgeek.com/sf
>         _______________________________________________
>         Snort-users mailing list
>         Snort-users () lists sourceforge net
>         Go to this URL to change user options or unsubscribe:
>         https://lists.sourceforge.net/lists/listinfo/snort-users
>         Snort-users list archive:
>         http://www.geocrawler.com/redir-sf.php3?list=snort-users
>         
>
>
>  



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users