RE: consensus on BASE

["Drew Burchett" <DrewB () united-systems com>]

While I can agree with most of what was said here, I can see one flaw
with Sguil.  I don't run any Linux boxes with a GUI frontend, and I
don't have the resources to load one just to run Sguil.  I'm using BASE
to help fine tune Snort as it's good to help weed out false positives
and for a good running overview of what is happening in realtime.  I
combine that with Snortalog for daily overviews of my data and then use
other programs to provide email and/or pager alerts on events that I
feel are important enough to draw my immediate attention.

I guess if BASE has one fatal flaw, there's no ability to see an IP
conversation that triggered an alert.  For example, if you see an ATTACK
RESPONSE 403 FORBIDDEN alert, there's no good way to tell if it was
malicious or if some dummy just typed in the wrong URL.

Drew Burchett
United Systems & Software
http://www.united-systems.com
Phone:  (270)527-3293
Fax:     (270)527-3132

> -----Original Message-----
> From: snort-users-admin () lists sourceforge net [mailto:snort-users-
> admin () lists sourceforge net] On Behalf Of Paul Schmehl
> Sent: Friday, May 26, 2006 12:54 PM
> Cc: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] consensus on BASE
>
> John Newman wrote:
> > Is the consensus that BASE is the best web front-end for snort out
there
> > (and I mean free, open source stuff)?  What are people's experiences
> > with sguil (which I realize is not web based).
> >
> > thanks,
> I think Base is probably the most popular open source front-end
> (although I don't have any data to back that up.)  It's certainly easy
> to install and use.  The problem with Base is that it gives you a
> sliding window of your events data, which tends to obscure real-time
> events from view unless they are large enough to draw attention (or
you
> just happen to notice them._  So, it's good for summarizing what's
going
> on, but not as good for real-time analysis of discrete events.
>
> Sguil is very difficult to install.  It requires quite a bit of
> preparation and installation of ancilliary apps to make it work.  (I'm
> trying to solve that on FreeBSD by developing ports for it that take
> care of all the dependencies.)  That's a consequence of the decision
to
> use tcl as the programming language, since it's not commonly installed
> on most platforms.  (It also uses some other apps which are not so
> common; sancp, p0f, tcpdump
>
> Once it's installed and configured (which is also a bit of work and
> requires a clear understanding of what you're doing), it provides a
> completely different, more detailed look at the data, in real time.
> It's easy to pick out events that need immediate followup and drill
down
> into packets to see what's really going on.
>
> So, I would say, Base is good for folks new to snort and especially
new
> to admining OSes, and sguil is good for folks who clearly understand
> what they're doing and want as much information about events as they
can
> get.
>
> --
> Paul Schmehl (pauls () utdallas edu)
> Adjunct Information Security Officer
> The University of Texas at Dallas
> http://www.utdallas.edu/ir/security/


--
CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended 
recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or 
distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and 
destroy all copies of the original message.

-- 
This message has been scanned for viruses and dangerous content by MailScanner and is believed to be clean.



-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid7521&bid$8729&dat1642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users