Snort mailing list archives
Re: "Best of breed" tools for Snort
From: Paul Schmehl <pauls () utdallas edu>
Date: Fri, 22 Apr 2005 12:35:42 -0500
--On Friday, April 22, 2005 09:56:58 AM -0600 Tristan RHODES <TristanRhodes () weber edu> wrote:
1. I would like to implement several (around 8) Snort sensors in our network. 2. I would like the rulesets/signatures to be updated automatically (or with a simple manual process). IDS Policy Manager Oinkmaster SnortCenter2 (What does this do? I cannot find good documentation on it.) Others?
Oinkmaster.
3. I would like tools to analyze the data and send alerts. Base SecureMine for Snort (I wish it was not Windows based) (Can both of these tools be used on the same data?)
Yes.
4. What data architecture is best? For instance, would it be best to have a central database server?
With your setup, yes, but you're going to have to watch the growth of the db, because it will slow down response times as the event count grows.
Briefly explain the data flows.
snort -> unified logs -> barnyard (essential for what you want to do) -> db
5. What are the best tools for each of these processes? Any other recommendations?
What OS do you plan on using? Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- "Best of breed" tools for Snort Tristan RHODES (Apr 22)
- Re: "Best of breed" tools for Snort Paul Schmehl (Apr 22)