Re: Snort & email

[Frank Knobbe <frank () knobbe us>]

On Wed, 2005-05-04 at 10:16 -0500, Dan S Baxter wrote:
> I'm setting up a Snort sensor in our environment and I am unable to
> determine how I might get emailed on alerts.  I understand some are using
> Swatch, but we are not logging to syslogs but rather to a mysql db.  What
> are others doing in this case?
>
> If I can't get it to alert me, it doesn't do me as much good, as I do not
> have the time to watch it 24/7.

Dan,

getting alerts in email is not substitute for watching 7/24. You will
get alerts around the clock. You guys are a fairly large organization,
so you will probably see a lot of alerts. Of course not every one is an
"incident", but might, so you have to review the alerts and packet
content anyway. 

That said, instead of watching an IDS console pull data out of a
database 7/24, you will be reading email 7/24. :)

To answer your question though: In addition to the database, also log
alerts to the log directory and have a cron job go through that log
directory, pulling out the alerts and emailing them to you. If a maximum
of 59 secs delay of an alert is tolerable, such emails are almost
real-time and deliver all information, including packet content if
configured properly.

Hope that helps,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part