[Snort-users] Snort Analisys platform

max supermax at ...12723...
Mon Nov 29 07:46:06 EST 2004


Hello Everybody.

I am working for a company that want to deploy a large infrastructure 
based on Snort for N-IDS. I plan we will have around 20-30 network 
sensor and I think it is possibile they will produce more than 2 Million 
Events / Day (they are the number of event present in the other 
commercial IDS platform already present).

I am confident Snort can work well in this enviroment, but I am 
evaluating software for the event analisys task. I used Acid for some 
times in smaller enviroment, and really like it, but I don't know if it 
can permit user to query events with a db with more than 10 Million events.

The platform should have strong possibility to see event from different 
point of view (source IP, Dest IP, Event Name, Network Sensor Name, etc) 
and drill down to better analize. This approch is the only one I have 
found that permit to analize so much events.

Do you have any experience to share on software (commercial/opensource), 
that can permit Snort events analisys for an enviroment with so much 
events?

Best Regards,
                      Max

PS
Sorry for my poor English




More information about the Snort-users mailing list