RE: only the "important stuff"

["M. Shirk" <shirkdog_linux () hotmail com>]

IDS matches signatures to network traffic on the wire. Someone could launch 
an attack against your servers, however, gain no access on them. These are 
not successful intrusions, just scans. I would be clear with your president 
about what he wants to see in a report.

Working with snort_on_acid, you could go through all the rule sets and look 
for obvious compromised traffic, such as back doors, ICMP and HTTP tunnels, 
as well as traffic that would only come from a server that has opened up a 
channel for an intruder to enter.

HOWEVER, now you have to take into account the applications on the servers 
for company. Lets say one snort sensor only has rules that would alert to a 
possibly compromised box. But, instead of a server being compromised, it has 
some web application, or database application running on bizarre ports. Now 
you have an automated alerting system to send email to the president. 
Instead of getting day-to-day alerts, he will be getting an important list 
of false positives. :-)

I second the notion of snort_on_acid, if your president wants only 
SUCCESSFUL intrusions, you will need to analyze the alerts and correlate 
them with host based intrusion technologies such as:

integrity checkers: aide/tripwire/osiris/samhaim
log files: syslog,secure,auth,messages
log monitors: swatch, tenshi
local *nix/Windows tools: netstat tcpview fport


Shirkdog



> From: SN ORT <snort_on_acid () yahoo com>
> To: Snort Users 
> <snort-users () lists sourceforge net>,steven.crandell () gmail com
> Subject: RE: [Snort-users] only the "important stuff"
> Date: Tue, 26 Oct 2004 10:15:31 -0700 (PDT)
>
> What?! You mean, send him all of the positive alerts?
>  Impossible without human intervention/correlation.
> You could move some sensors back or set some variables
> that look at only important machines, or even setup
> another instance of Snort that runs only custom
> signatures you're sure never produce false
> positives/negative..etc, but then you could very well
> miss some legitimate break-ins. You could also try to
> customize the IDS so that each signature is customized
> to vulnerable servers. IOW, why would I want to
> receive an IIS vulnerability alert when my server is
> running apache? So I would set a var
> $apache_servers=IPaddress(range) and then set each
> Apache signature to destination = "$apache_servers",
> and at the same time have the IIS signatures only
> relate to IIS servers. Wow, there's a concept.
>
>
> Nah, you'd have to have a brain look at those first,
> and then send them to your presidente (although
> products like from ISS contain correlation
> capabilities)
>
> Cheese!
>
> Marc
>
>
> --__--__--
>
> Message: 9
> Date: Tue, 26 Oct 2004 09:34:56 -0700
> From: Steven Crandell <steven.crandell () gmail com>
> Reply-To: Steven Crandell <steven.crandell () gmail com>
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] only the "important stuff"
>
> Hi all,
>
> I have snort running the way I want it to run, etc.
> I'm also using
> logcheck to watch the logs and email me when someone
> exceeds my
> thresholds.  Anyway, I'm pretty satisfied with how all
> of that is
> working.
>
> This morning the president of the co. has asked that
> he -not- receive
> the day to day alerts and would only like to receive
> alerts on
> "successful" intrusions.
>
> Are there certain rules that would never be triggered
> unless someone
> actually gets into a monitored system?  Or anything
> along those lines?
>
> I know this is a little off the wall, but any
> help/suggestions would
> be greatly appreciated.
>
> regards,
> --
> Steven Crandell
> steven.crandell () gmail com
>
>
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail Address AutoComplete - You start. We finish.
> http://promotions.yahoo.com/new_mail
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by:
> Sybase ASE Linux Express Edition - download now for FREE
> LinuxWorld Reader's Choice Award Winner for best database on Linux.
> http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

_________________________________________________________________
FREE pop-up blocking with the new MSN Toolbar – get it now! 
http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/



-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users