Multiple Sensors/Distributed Snort Config.

["Dan Brummer" <dan.brummer () vegas com>]

Hello,
I have been a Snort user for quite some time now and I have a few
questions regarding setting up a distributed Snort system.  I'm planning
to put multiple sensors on my enterprise network and have all of these
feed to a central database server.  From my research I understand the
best way to do this is have each remote sensor send its Snort output
using MySQL.  Is this the best way of doing this?  Are there any
applications to help me with what I'm trying to do?  What about the
rules and and making sure they're shared and up-to-date on all the
sensors?  Do I need to be running snort on the central database server
if all it's doing is receiving sensor outputs and displaying reports
using ACID or BASE?  
 
Any insight on this I would greatly appreciate it.
 
Thank you,
Dan


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users