Re: Distributed Snort

[Ian Bowers <iggdawg () gmail com>]

I actually do what you're asking 2 ways in my lab.  I have 2 snort sensors
monitoring 2 different segments.  They both have their own DB and BASE GUI.
 I'm playing with snorby and sguil as well, but for some reason BASE always
makes more sense to me.  Anyways, snort outputs to unified2 on each sensor.
 Barnyard has 2 DB output lines for each, with hostname-interface as the
sensor name.  So basically each BASE install sees the alerts from both
sensors

The other way I've done it is by having each sensor report only to their
own database.  Then I define the other sensor's database as the "archive
database" in base_conf.php .  This way whichever sensor I'm on I can switch
between what dataset I'm looking at by clicking "use archive database" or
"use snort database".   This is how I originally set things up when I was
comparing the alerts I'd get from snort and suricata when using the same
ruleset for both.  It helped me keep the data more segregated and cut down
on how specific I'd have to be during searches.

Regards,
-Ian

On Fri, May 11, 2012 at 12:28 PM, Joel Esler <jesler () sourcefire com> wrote:

> Have barnyard2 read the unified2 files from both sensors and report back
> to a single DB collection instance.  Just name the sensors different things
> in your barnyard2.conf file.
>
>
> On May 11, 2012, at 11:21 AM, Adam Orton wrote:
>
> > Hey Guys,
> >
> > I am currently running 2 snort sensors, both of which have their own
> standalone SQL DB and BASE GUI installed.
> > Is there a best practise way of dragging both sets of alert data back to
> one central location and viewing with a GUI such as BASE?
> > Regards,
> >
> > Adam
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!