[Snort-users] Snort Analysis platform
Basselgia, Barry A Mr (NAF Atsugi)
BABasselgia at ...12104...
Sat Nov 27 20:54:05 EST 2004
Have you looked at Open Aanval (www.aanval.com). I use Open Aanval and ACID
together, I find myself switching back and forth depending on what I'm
I've found the response time from Open Aanval stays pretty much the same
even as the alerts database grows. Unlike ACID that seems to slow down a
lot when the database gets large.
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of mamo
Sent: Saturday, November 27, 2004 6:44 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Snort Analisys platform
I am working for a company that want to deploy a large infrastructure
based on Snort for N-IDS. I plan we will have around 20-30 network
sensor and I think it is possibile they will produce more than 2
Million Events / Day (they are the number of event present in the
other commercial IDS platform already present).
I am confident Snort can work well in this enviroment, but I am
evaluating software for the event analisys task. I used Acid for some
times in smaller enviroment, and really like it, but I don't know if
it can permit user to query events with a db with more than 10 Million
The platform should have strong possibility to see event from
different point of view (source IP, Dest IP, Event Name, Network
Sensor Name, etc) and drill down to better analize. This approch is
the only one I have found that permit to analize so much events.
Do you have any experience to share on software
(commercial/opensource), that can permit Snort events analisys for an
enviroment with so much events?
Sorry for my poor English
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users