Snort mailing list archives
Extracting reports per IP address
From: "Landon Stewart | Superb Internet Corp." <landonstewart () gmail com>
Date: Tue, 14 Nov 2006 14:31:15 -0800
We provide shared hosting, colocation services and server rental. We need to enforce our AUP more proactively and detect malicious outgoing traffic before we get complaints about it. We are mirroring outgoing traffic for 3 quite large VLANS to a machine with a GigE interface. The machine is running snort. I have not even come close to figuring out which rules we want to load yet. What I want to do to be able to generate a report on a regular basis looking for all of our IP addresses that were the source of a triggered event and report those events to the customer responsible for that server. While BASE provides a good way of viewing whats in the snort database it does not do what I need. I'm having a lot of trouble finding information on reporting because the snort database, while optimized for speed, appears to be quite complex. On regular intervals I want to: - Get all the source IP addresses and discard those that do not belong to us since the last run - For each IP address that has one or more event I want to list all the events for that IP address - I will then open a ticket on the responsible customer's account with this information alerting them to the possibility of a policy violation or security issue with their server. Seems pretty straightforward but how can I get this information in a readable report something like what is produced with the "Email Alert(s) (full)" output included in BASE? -- Landon Stewart Superb Internet Corporation Toll Free: 888-354-6128 x 4199 (US/Canada) International: 604-638-2525 x 4199 CELEBRATING 10 YEARS OF HOSTING EXCELLENCE! 1996 - 2006 Web hosting and more "Ahead of the Rest": http://www.superb.net
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Extracting reports per IP address Landon Stewart | Superb Internet Corp. (Nov 14)
- Re: Extracting reports per IP address Dev Anand (Nov 14)
- Re: Extracting reports per IP address Kevin Johnson (Nov 14)