[Snort-users] How do people generally trigger alerts?
Jason.Haar at ...294...
Tue Jun 10 17:22:19 EDT 2003
I've just read "Real-Time Alerting with Snort"
which brought up some interesting ways in which to trigger alerts.
We've basically been doing what the article says for some time now
(syslog-ng + swatch + script to manage sending email/SMS or TAP pages), but
the author picked up on something I hadn't...
So far I've been rewriting rules that I want to trigger an action via
changing the "msg:" string to contain a string to which swatch responds.
This works but does mean I'm altering/adding rules that aren't in keeping
with the existing Snort ruleset. Their idea of use the Priority tag sounds a
lot better. However, they mentioned triggering swatch on "Priority: 1" - but
a MAJOR part of Snort's ruleset is "Priority: 1", so it sounds to me like an
"unused" priority would be a better choice.
So my questions are:
a) is there an even better way of doing this?
b> Would "Priority: 100" ever be used by the rulesets? If not, it seems like
a good idea to me to post-process the rules, altering the priority to
100+ for the rules you want to trigger off. You could use "100" for one
set of people, "101" for another, etc
c) Does priority have any *real* value within Snort itself that fiddling
with it would break?
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
More information about the Snort-users