Re: Homebrew Snort Reactive/Unified2 output

[Korodev <korodev () gmail com>]

> At the risk of getting into a pilosophical discussion...
>
> The absolute fastest place to fire a response post-detection would be
> an output plugin.  There's no need to hook the U2 output plugin or
> write an output module for BY2, depending on a number of factors
> you're not going to get the absolute fastest activation time for your
> code from the point of detection.

That seems to be the general consensus. To avoid the philosophical
discussion, I'm not only interested in IPS style responses, but simply
interested in getting a 'heartbeat' signal as soon as an alert has
tripped. My only reason for implying hooking the U2 output plugin, was
my desire to preserve U2 output for later processing. I feel like I'm
being directed away from that, but not sure why (?) I haven't played
with Snort's output plugins in the past, so this will be a beneficial
exercise.

\\korodev

------------------------------------------------------------------------------
Create and publish websites with WebMatrix
Use the most popular FREE web apps or write code yourself; 
WebMatrix provides all the features you need to develop and 
publish your website. http://p.sf.net/sfu/ms-webmatrix-sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users