[Snort-users] only the "important stuff"
shirkdog_linux at ...125...
Tue Oct 26 11:33:01 EDT 2004
IDS matches signatures to network traffic on the wire. Someone could launch
an attack against your servers, however, gain no access on them. These are
not successful intrusions, just scans. I would be clear with your president
about what he wants to see in a report.
Working with snort_on_acid, you could go through all the rule sets and look
for obvious compromised traffic, such as back doors, ICMP and HTTP tunnels,
as well as traffic that would only come from a server that has opened up a
channel for an intruder to enter.
HOWEVER, now you have to take into account the applications on the servers
for company. Lets say one snort sensor only has rules that would alert to a
possibly compromised box. But, instead of a server being compromised, it has
some web application, or database application running on bizarre ports. Now
you have an automated alerting system to send email to the president.
Instead of getting day-to-day alerts, he will be getting an important list
of false positives. :-)
I second the notion of snort_on_acid, if your president wants only
SUCCESSFUL intrusions, you will need to analyze the alerts and correlate
them with host based intrusion technologies such as:
integrity checkers: aide/tripwire/osiris/samhaim
log files: syslog,secure,auth,messages
log monitors: swatch, tenshi
local *nix/Windows tools: netstat tcpview fport
>From: SN ORT <snort_on_acid at ...131...>
>To: Snort Users
><snort-users at lists.sourceforge.net>,steven.crandell at ...11827...
>Subject: RE: [Snort-users] only the "important stuff"
>Date: Tue, 26 Oct 2004 10:15:31 -0700 (PDT)
>What?! You mean, send him all of the positive alerts?
> Impossible without human intervention/correlation.
>You could move some sensors back or set some variables
>that look at only important machines, or even setup
>another instance of Snort that runs only custom
>signatures you're sure never produce false
>positives/negative..etc, but then you could very well
>miss some legitimate break-ins. You could also try to
>customize the IDS so that each signature is customized
>to vulnerable servers. IOW, why would I want to
>receive an IIS vulnerability alert when my server is
>running apache? So I would set a var
>$apache_servers=IPaddress(range) and then set each
>Apache signature to destination = "$apache_servers",
>and at the same time have the IIS signatures only
>relate to IIS servers. Wow, there's a concept.
>Nah, you'd have to have a brain look at those first,
>and then send them to your presidente (although
>products like from ISS contain correlation
>Date: Tue, 26 Oct 2004 09:34:56 -0700
>From: Steven Crandell <steven.crandell at ...11827...>
>Reply-To: Steven Crandell <steven.crandell at ...11827...>
>To: snort-users at lists.sourceforge.net
>Subject: [Snort-users] only the "important stuff"
>I have snort running the way I want it to run, etc.
>I'm also using
>logcheck to watch the logs and email me when someone
>thresholds. Anyway, I'm pretty satisfied with how all
>of that is
>This morning the president of the co. has asked that
>he -not- receive
>the day to day alerts and would only like to receive
>Are there certain rules that would never be triggered
>actually gets into a monitored system? Or anything
>along those lines?
>I know this is a little off the wall, but any
>be greatly appreciated.
>steven.crandell at ...11827...
>Do you Yahoo!?
>Yahoo! Mail Address AutoComplete - You start. We finish.
>This SF.Net email is sponsored by:
>Sybase ASE Linux Express Edition - download now for FREE
>LinuxWorld Reader's Choice Award Winner for best database on Linux.
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:
FREE pop-up blocking with the new MSN Toolbar get it now!
More information about the Snort-users