Best practices for monitoring / actions?

["Daryl J. Rue" <drue () mail paydq com>]

We have Snort in place and are looking for next steps. 

 

Specifically, I think I am after documentation on best practices for using
snort, responding to alerts, predefined actions to evaluate or assess.  We
are a credit card transaction processing company with 11 employees.  

 

I might be after something like this for example:

 

Snort is actively listening for DOS attacks.  If xxxx threshold is reached
we will be alerted by email.  After investigation we will asses the
sitiuation and either:  1.  Block traffic from that source and report the
attack to the service provider or 2.  continue to monitor until the next
threshold is met, 3.  etc...   

 

I think we need to be able to tell our clients something other than we
monitor the alerts and respond as neccessary, and we don't have the
resources to have someone monitor this full time if you know what I mean.  

 

Any suggestions on what everyone else is doing would also be benefitial, but
if there are any best practice guides please point me in the right
direction.  

 

 

Thanks, 

 

 

Daryl J. Rue

Network Manager

Crescent Systems

25 Main Place Suite 400

Council Bluffs, IA 51503

Phone: 712-388-2132 x205

Fax: 888-741-1648

 

Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users