RE: Snort for Windows, filter for syslog ?

["Michael Steele" <michaels () winsnort com>]

You can have anything sent to Syslog as long as it goes through the Event
Log in Windows. Find the alert in the Event Log and search on any of that
text.

Kindest regards,
Michael...

WINSNORT.com Management Team Member
--
****************** Established ~ 2001 *******************
*          Visit Us @ http://www.winsnort.com           *
*      ~~ FREE WinIDS Snort installation guides ~~      *
*               ~~ FREE support forums ~~               *
* Snort: Open Source Network IDS - http://www.snort.org *
*********************************************************

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of
Turnquist,Wayne
Sent: Thursday, January 12, 2006 7:00 AM
To: snort-users mailinglist
Subject: [Snort-users] Snort for Windows, filter for syslog ?

I have the newest version of Snort/Base on a windows 2003.

I now have the rules tweaked to a point where i have very few alerts showing
up in base.

I have kiwi syslog up and running where i'm goint to use for very critical
events are sent. Example, 3 fail logins with sound alerts, log all
successful login to a file, and ect

I was wondering if it is possible to have syslog alerts sent if the
classification is for example trojan-activity along with logging to base?


thanks
wt


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=ick
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=ort-users







-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users