RE: mail notification

["Harper, Patrick" <Patrick.Harper () phns com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

First for the drinking,
http://www.theadamsfamily.net/~erek/snort/drinking_game.txt


Then for the docs 

http://www.snort.org/docs/FAQ.txt

 
5.9 How do I get snort to e-mail me alerts?

You can't. Such a process would slow Snort down too much to make it
of any use.
Instead, log to syslog and use swatch or logcheck to parse over the
plaintext
logfiles.

With the logsurfer docs, this might get you on the road to doing
something with
snort & logsurfer:

    http://www.obfuscation.org/emf/logsurfer/snort.txt

JASON HAAR provided an example Swatch (3.1beta) config that emails
alerts:

    http://www.theadamsfamily.net/~erek/snort/snort-swatch.conf.txt

Here are some docs on swatch:

  * http://www.oit.ucsb.edu/~eta/swatch/
  * http://www.stanford.edu/~atkins/swatch
  * http://rr.sans.org/sysadmin/swatch.php
  * http://www.enteract.com/~lspitz/swatch.html
  *
http://www.cert.org/security-improvement/implementations/i042.01.html

IDS Center (see FAQ 5) on Win32 will also mail alerts.

 
- -----Original Message-----
From: Esler, Joel - Contractor [mailto:joel.esler () rcert-s army mil] 
Sent: Tuesday, December 21, 2004 11:59 AM
To: snort-users () lists sourceforge net
Subject: RE: [Snort-users] mail notification

You don't use acid for this, you can use..
http://swatch.sourceforge.net/

Swatch.

- -----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Esler,
Joel - Contractor
Sent: Tuesday, December 21, 2004 12:45 PM
To: snort-users () lists sourceforge net
Subject: RE: [Snort-users] mail notification


How many drinks is this?  Anyone know?

- -----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Jimmy
Hayes
Sent: Tuesday, December 21, 2004 12:37 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] mail notification


Hello I just finished installing snort Version 2.2.0 (Build 30) with
mysql database and ACID.

My question is, I can see some alerts by going to my ACID site, but
is
there a way or an option on snort so That I can e-mail me when an
alert
is triggered? I tried looking in the manual but didn't find anything.

thanks



- -------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real
users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=ort-users


- -------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real
users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=ort-users


- -------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real
users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?listžort-users



-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQchmzJiWafDb7+B/EQLwdwCg2XpZZECREclRgMIeodMdf/lw9DwAoMig
QloE5IqUcx1bWPwYH6cTj+qJ
=zb8A
-----END PGP SIGNATURE-----




Disclaimer:
This electronic message, including any attachments, is confidential and intended solely for use of the intended 
recipient(s). This message may contain information that is privileged or otherwise protected from disclosure by 
applicable law. Any unauthorized disclosure, dissemination, use or reproduction is strictly prohibited. If you have 
received this message in error, please delete it and notify the sender immediately. 





-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users