Snort mailing list archives
Multiple Sensors/Distributed Snort Config.
From: "Dan Brummer" <dan.brummer () vegas com>
Date: Thu, 13 Jul 2006 10:17:08 -0700
Hello, I have been a Snort user for quite some time now and I have a few questions regarding setting up a distributed Snort system. I'm planning to put multiple sensors on my enterprise network and have all of these feed to a central database server. From my research I understand the best way to do this is have each remote sensor send its Snort output using MySQL. Is this the best way of doing this? Are there any applications to help me with what I'm trying to do? What about the rules and and making sure they're shared and up-to-date on all the sensors? Do I need to be running snort on the central database server if all it's doing is receiving sensor outputs and displaying reports using ACID or BASE? Any insight on this I would greatly appreciate it. Thank you, Dan
------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Multiple Sensors/Distributed Snort Config. Dan Brummer (Jul 13)
- Re: Multiple Sensors/Distributed Snort Config. Lee Clemens (Jul 13)
- Re: Multiple Sensors/Distributed Snort Config. Andreas Östling (Jul 14)