Snort mailing list archives
RE: only the "important stuff"
From: "Jacques Brierre" <jbrierre () Lanier com>
Date: Tue, 26 Oct 2004 15:25:36 -0400
Apparently this person only wants reports AFTER the intrusion. Okay... be thankful that s/he will only know post-facto and will not be 'riding' you during a stressful time of hunting and intense blocking. --of course that just one way to look at this :-) -jacques. "M. Shirk" <shirkdog_linux () hotmail com> Sent by: snort-users-admin () lists sourceforge net 10/26/2004 02:31 PM To: snort-users () lists sourceforge net cc: Subject: RE: [Snort-users] only the "important stuff" IDS matches signatures to network traffic on the wire. Someone could launch an attack against your servers, however, gain no access on them. These are not successful intrusions, just scans. I would be clear with your president about what he wants to see in a report. Working with snort_on_acid, you could go through all the rule sets and look for obvious compromised traffic, such as back doors, ICMP and HTTP tunnels, as well as traffic that would only come from a server that has opened up a channel for an intruder to enter. HOWEVER, now you have to take into account the applications on the servers for company. Lets say one snort sensor only has rules that would alert to a possibly compromised box. But, instead of a server being compromised, it has some web application, or database application running on bizarre ports. Now you have an automated alerting system to send email to the president. Instead of getting day-to-day alerts, he will be getting an important list of false positives. :-) I second the notion of snort_on_acid, if your president wants only SUCCESSFUL intrusions, you will need to analyze the alerts and correlate them with host based intrusion technologies such as: integrity checkers: aide/tripwire/osiris/samhaim log files: syslog,secure,auth,messages log monitors: swatch, tenshi local *nix/Windows tools: netstat tcpview fport Shirkdog
From: SN ORT <snort_on_acid () yahoo com> To: Snort Users <snort-users () lists sourceforge net>,steven.crandell () gmail com Subject: RE: [Snort-users] only the "important stuff" Date: Tue, 26 Oct 2004 10:15:31 -0700 (PDT) What?! You mean, send him all of the positive alerts? Impossible without human intervention/correlation. You could move some sensors back or set some variables that look at only important machines, or even setup another instance of Snort that runs only custom signatures you're sure never produce false positives/negative..etc, but then you could very well miss some legitimate break-ins. You could also try to customize the IDS so that each signature is customized to vulnerable servers. IOW, why would I want to receive an IIS vulnerability alert when my server is running apache? So I would set a var $apache_servers=IPaddress(range) and then set each Apache signature to destination = "$apache_servers", and at the same time have the IIS signatures only relate to IIS servers. Wow, there's a concept. Nah, you'd have to have a brain look at those first, and then send them to your presidente (although products like from ISS contain correlation capabilities) Cheese! Marc --__--__-- Message: 9 Date: Tue, 26 Oct 2004 09:34:56 -0700 From: Steven Crandell <steven.crandell () gmail com> Reply-To: Steven Crandell <steven.crandell () gmail com> To: snort-users () lists sourceforge net Subject: [Snort-users] only the "important stuff" Hi all, I have snort running the way I want it to run, etc. I'm also using logcheck to watch the logs and email me when someone exceeds my thresholds. Anyway, I'm pretty satisfied with how all of that is working. This morning the president of the co. has asked that he -not- receive the day to day alerts and would only like to receive alerts on "successful" intrusions. Are there certain rules that would never be triggered unless someone actually gets into a monitored system? Or anything along those lines? I know this is a little off the wall, but any help/suggestions would be greatly appreciated. regards, -- Steven Crandell steven.crandell () gmail com __________________________________ Do you Yahoo!? Yahoo! Mail Address AutoComplete - You start. We finish. http://promotions.yahoo.com/new_mail ------------------------------------------------------- This SF.Net email is sponsored by: Sybase ASE Linux Express Edition - download now for FREE LinuxWorld Reader's Choice Award Winner for best database on Linux. http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
_________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar ? get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/ ------------------------------------------------------- This SF.Net email is sponsored by: Sybase ASE Linux Express Edition - download now for FREE LinuxWorld Reader's Choice Award Winner for best database on Linux. http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- only the "important stuff" Steven Crandell (Oct 26)
- Re: only the "important stuff" Jason Haar (Oct 26)
- <Possible follow-ups>
- RE: only the "important stuff" SN ORT (Oct 26)
- RE: only the "important stuff" M. Shirk (Oct 26)
- RE: only the "important stuff" Jacques Brierre (Oct 26)
- RE: only the "important stuff" Orit Vidas (Oct 26)