[Snort-users] How do people generally trigger alerts?

Jason Haar Jason.Haar at ...294...
Tue Jun 10 17:22:19 EDT 2003


I've just read "Real-Time Alerting with Snort"
<URL:http://www.linuxsecurity.com/feature_stories/feature_story-144.html> -
which brought up some interesting ways in which to trigger alerts.

We've basically been doing what the article says for some time now
(syslog-ng + swatch + script to manage sending email/SMS or TAP pages), but
the author picked up on something I hadn't...

So far I've been rewriting rules that I want to trigger an action via
changing the "msg:" string to contain a string to which swatch responds.
This works but does mean I'm altering/adding rules that aren't in keeping
with the existing Snort ruleset. Their idea of use the Priority tag sounds a
lot better. However, they mentioned triggering swatch on "Priority: 1" - but
a MAJOR part of Snort's ruleset is "Priority: 1", so it sounds to me like an
"unused" priority would be a better choice.

So my questions are:

a) is there an even better way of doing this?
b> Would "Priority: 100" ever be used by the rulesets? If not, it seems like
   a good idea to me to post-process the rules, altering the priority to
   100+ for the rules you want to trigger off. You could use "100" for one
   set of people, "101" for another, etc
c) Does priority have any *real* value within Snort itself that fiddling
   with it would break?


-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1




More information about the Snort-users mailing list