Re: BASE or Snort Report ???

[Jun Wan <junwei_wan () hotmail com>]

I couldn't agree more with Bamm, BASE & Snort Report are good for Snort beginner like me. I was so excited when I saw 
all the alerts from Base & Snort Report, then I learned how to tune rules and make BASE and Snort Report more user 
friendly, it was fun. I found Sguil is fantastic when I would like to use Snort to dig information a bit deeper 
including what rules produced which alerts? was the attack successful? which servers were compromised and which servers 
weren't compromised? What does the signature pattern look like? assignment description/comments/escalation of the 
alerts, real time alert counter, wireshark, DNS lookup, etc and more. All these information are in one NSM tool---Sguil.
 
I 've only had 6 months of experience with BASE and Snort Report, and 2 weeks' with Sguil, I think Sguil is a more 
comprehensive tool than BASE and Snort Report regarding detailed information
 
I will try Snorby one day and I believe it would be another fantastic NSM tool as many recommended it.
 
That's my 2c
 
> Date: Wed, 5 Jan 2011 08:51:16 -0500
> From: bamm.visscher () gmail com
> To: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] BASE or Snort Report ???
>
> For the record, no, Sguil is not a dead project. The community is
> still quite active even if commits to CVS haven't been happening. Join
> #snort-gui on irc.freenode.net and you'll find a number of seasoned
> pro's willing to help/discuss Sguil, Snort, NSM, IDS, security,
> fishing, music, .....
>
> With that said, I wouldn't recommend Sguil for someone just starting
> out with Snort or who is looking for an "alert browser". Take your
> time. Install Snorby or syslog alerts to Splunk. Do some analysis. If
> over time you come to the conclusion that you need more data and tools
> to facilitate better analysis, then check out Sguil and the concept of
> NSM.
>
> Bamm
>
>
>
> On Tue, Jan 4, 2011 at 10:01 PM, Garland, Ken R <garlandkr () gmail com> wrote:
> > With sguil replace the word 'excellent' with 'horrid' in regards to the web
> > interface - It's also a dead project as far as I can tell.
> > On the topic of vaporware, didn't BASE get dumped some time ago as well?
> > Two jobs ago I wrote a custom interface using Python/Pylons that had
> > realtime views and analysis. At my last position I put Snorby in place and
> > that was a real treat, blew me away with the reports available and
> > interface. They just released 2.0 which I had been waiting for, but I've
> > since left that company and I've graduated from dealing with such things.
> > Chose something that will have room to grow and has, at the minimum, a
> > current set of interested developers. As a few others have pointed out you
> > might want to consider using plugins for snort to send alerts or using
> > syslog to deal with alerts, syslog-ng can handle alerts all on its own with
> > quite a bit of intelligence. I always liked using a notification system
> > outside of Snort as there are many other things in the admin world that
> > require attention. I keep them in a central place with a central syslog-ng
> > or monitoring system.
>
> -- 
> sguil - The Analyst Console for NSM
> http://sguil.sf.net
>
> ------------------------------------------------------------------------------
> Learn how Oracle Real Application Clusters (RAC) One Node allows customers
> to consolidate database storage, standardize their database environment, and, 
> should the need arise, upgrade to a full multi-node Oracle RAC database 
> without downtime or disruption
> http://p.sf.net/sfu/oracle-sfdevnl
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
Learn how Oracle Real Application Clusters (RAC) One Node allows customers
to consolidate database storage, standardize their database environment, and, 
should the need arise, upgrade to a full multi-node Oracle RAC database 
without downtime or disruption
http://p.sf.net/sfu/oracle-sfdevnl

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users