Re: "Best of breed" tools for Snort

[Paul Schmehl <pauls () utdallas edu>]

--On Friday, April 22, 2005 09:56:58 AM -0600 Tristan RHODES 
<TristanRhodes () weber edu> wrote:

> 1.  I would like to implement several (around 8) Snort sensors in our
> network.
>
> 2.  I would like the rulesets/signatures to be updated automatically
> (or with a simple manual process).
> IDS Policy Manager
> Oinkmaster
> SnortCenter2 (What does this do?  I cannot find good documentation on
> it.)
> Others?
Oinkmaster.

> 3.  I would like tools to analyze the data and send alerts.
> Base
> SecureMine for Snort  (I wish it was not Windows based)
> (Can both of these tools be used on the same data?)
Yes.

> 4.  What data architecture is best?  For instance, would it be best to
> have a central database server?

With your setup, yes, but you're going to have to watch the growth of the 
db, because it will slow down response times as the event count grows.

>  Briefly explain the data flows.

snort -> unified logs -> barnyard (essential for what you want to do) -> db
> 5.  What are the best tools for each of these processes?  Any other
> recommendations?
What OS do you plan on using?

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users