Snort mailing list archives
RE: ACID Dates
From: "Shackleford, David M." <David.Shackleford () nscorp com>
Date: Mon, 31 Jan 2005 09:28:55 -0500
I agree with Wes. We use OpenAanval for more "real-time" monitoring, and the ability to conduct investigations of events by attaching notes to Collection Groups and sending simple email alerts. However, BASE has much more granular search capabilities, and it is possible to import an entire query into an AG and then report on it. We use this for doing weekly/monthly malware counts, searching on the signature "roughly" equaling "malware" (from Bleeding Snort sigs). --Dave ----------------------------- Dave Shackleford, CISSP Information Security Architect Norfolk Southern Corp. (404)962-5620 david.shackleford () nscorp com -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Wes Young Sent: Monday, January 31, 2005 8:58 AM To: Chris Vaughan Cc: Dave C; snort-users () lists sourceforge net Subject: Re: [Snort-users] ACID Dates -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I run them both, I don't think either one is better than the other, they both have very powerful features.. Aanval has a great way of managing alerts and sifting through large amounts of data, but it has problems extracting data into emails etc... this is where I think BASE can play a very good role with it's alert groups etc.... IMO running both simultainiously will give you a very powerful combo..... Chris Vaughan wrote: | I looked at the website, and it looks a lot like ACID. | | What do you like about BASE so much more? What are it's advantages over ACID? What about compared to OpenAanval? | | -----Original Message----- | From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Dave C | Sent: Wednesday, January 26, 2005 6:17 PM | To: snort-users () lists sourceforge net | Subject: Re: [Snort-users] ACID Dates | | Dump ACID and use BASE | http://secureideas.sourceforge.net/ | | ----- Original Message ----- | From: "James M. Driskell" <jdriskell () ups edu> | To: <snort-users () lists sourceforge net> | Sent: Wednesday, January 26, 2005 4:50 PM | Subject: [Snort-users] ACID Dates | | | |>Hello List, |> |>I was running some Snort reports this morning using the ACID interface and |>I |>noticed that the drop-down year selection window only goes up to 2004. |>I'm |>using ACID v0.9.6b23. Any ideas on how to fix this? |> |>Thanks, |> |>Jim Driskell |> | | | | | | ------------------------------------------------------- | This SF.Net email is sponsored by: IntelliVIEW -- Interactive | Reporting Tool for open source databases. Create drag-&-drop reports. | Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. | Download a FREE copy at http://www.intelliview.com/go/osdn_nl | _______________________________________________ | Snort-users mailing list | Snort-users () lists sourceforge net | Go to this URL to change user options or unsubscribe: | https://lists.sourceforge.net/lists/listinfo/snort-users | Snort-users list archive: | http://www.geocrawler.com/redir-sf.php3?list=snort-users | | | | | ------------------------------------------------------- | This SF.Net email is sponsored by: IntelliVIEW -- Interactive | Reporting Tool for open source databases. Create drag-&-drop reports. | Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. | Download a FREE copy at http://www.intelliview.com/go/osdn_nl | _______________________________________________ | Snort-users mailing list | Snort-users () lists sourceforge net | Go to this URL to change user options or unsubscribe: | https://lists.sourceforge.net/lists/listinfo/snort-users | Snort-users list archive: | http://www.geocrawler.com/redir-sf.php3?list=ort-users | | - -- Wes Young Network Secuity Analyst University at Buffalo GPG Key: http://saxjazman9-security.blogspot.com/2005/01/gpg-key.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFB/jlP1M5o0FsrrbERAqyDAJ981klq6LR4eI8FlLdSKGdZV0+axQCfXvQ5 xhTy7RwyfYvtHFAyxhpPafY= =21HH -----END PGP SIGNATURE----- ------------------------------------------------------- This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting Tool for open source databases. Create drag-&-drop reports. Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. Download a FREE copy at http://www.intelliview.com/go/osdn_nl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting Tool for open source databases. Create drag-&-drop reports. Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. Download a FREE copy at http://www.intelliview.com/go/osdn_nl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: ACID Dates, (continued)
- Re: ACID Dates Dave C (Jan 28)
- ACID Problems (here's your fix it) Joel Esler (Jan 28)
- RE: ACID Dates Chris Vaughan (Jan 28)
- RE: ACID Dates Kevin Johnson (Jan 28)
- RE: ACID Dates Michael Steele (Jan 28)
- Re: ACID Dates Wes Young (Jan 31)
- RE: ACID Dates Michael Steele (Jan 31)
- RE: ACID Dates Kevin Johnson (Jan 31)
- RE: ACID Dates Joel Esler (Feb 01)
- RE: ACID Dates Kevin Johnson (Jan 28)
- RE: ACID Dates nhdave (Jan 31)
- RE: ACID Dates Shackleford, David M. (Jan 31)