Re: OpenSource Alternative to SourceFire's RNA

["AJ Butcher, Information Systems and Computing" <Alex.Butcher () bristol ac uk>]

--On 31 March 2004 09:39 -0600 Josh Berry <josh.berry () netschematics com> 
wrote:

> I am not looking for correlation, I have already done a great deal of
> development on an application that correlates Snort/Nessus/Windows Event
> Logs/and working on Firewall logs.  What I want is something that tracks
> MAC's across the network, updating information such as current IP address,
> operating systems, port being used, and services running on the used
> ports.  This information should be collected passively like SourceFire's
> RNA or similar to Tenable's NeVo product.

Ossim also integrates with ntop, p0f and arpwatch (arpwatch needs a small 
patch to allow it to listen on interfaces without any IPv4 address). You 
can also assign values to assets which it uses to calculate 
most-at-risk/most-likely-to-be-compromised hosts.

> With this kind of information an adaptive security environment could be
> created that automatically tunes IDS/VA devices to match the current
> threat level for the network environment.
>
> The only way I know of how to do this is to create signatures in Snort
> that recognize specific services and Operating Systems, log them in a
> format such as CSV and then run a background process that tails the CSV
> file and inputs new information into a database, or updates old
> information with current changes.
>
> This method however would be a big undertaking as there are thousands of
> applications and versions out there.  The most efficient method I can
> think of is to classify application types (DB/WWW/FTP/DNS) with common
> port listings and assign signatures to the class listings in one big
> database.  Once done a script could be created to automatically generate
> the signatures.

As far as I can see, this is exactly the direction ossim is heading.

> Thanks

Best Regards,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9




-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users