Re: Snort Frontend Compare

[Dustin Webber <dustin.webber () gmail com>]

Hey James,

Great work on putting this together. I have a few features to add to snorbys list.

- Hotkeys - (you can use the whole snorby UI without touching the mouse once - mostly because I hate using a mouse)
- Custom Lookups - You can add your own URI apis form doing custom src/dst addr lookups.. example: 
http://www.mcafee.com/threat-intelligence/ip/default.aspx?ip=${ip}
- Comment system.. (not really important but some users find its incredibly useful)

Also to sure what you mean by `Graph # of alerts by time` - thats what the main dashboard graph does.

Feature comparison matrix additions/thoughts:

- Does Base or squert support other databases? snorby supports everything currently support by the so_database output 
plugin.

Also, not 100% sure Squert makes sense in this comparison.. its purpose is in a totally different direction.

Anyways, great work and thanks for putting this together.

- Dustin Willis Webber


On Sep 16, 2011, at 11:16 AM, James Lay wrote:

> Hey all!
>
> Here's the Snort front end compre that was brought up last month.  It is a
> feature compare only of the "big three" (Base, Snorby, SQueRT), not a
> review.  Please let me know if I've missed something, or if there are any
> errors.
>
> http://malwareandmore.blogspot.com/2011/09/snort-frontend-compare.html
>
> James
>
>
> ------------------------------------------------------------------------------
> BlackBerry® DevCon Americas, Oct. 18-20, San Francisco, CA
> http://p.sf.net/sfu/rim-devcon-copy2
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!


------------------------------------------------------------------------------
BlackBerry® DevCon Americas, Oct. 18-20, San Francisco, CA
http://p.sf.net/sfu/rim-devcon-copy2
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!