[Snort-users] only the "important stuff"

Jacques Brierre jbrierre at ...12536...
Tue Oct 26 12:26:05 EDT 2004


Apparently this person only wants reports AFTER the intrusion. Okay... be 
thankful that s/he
will only know post-facto and will not be 'riding' you during a stressful 
time of hunting and
intense blocking. --of course that just one way to look at this :-)

-jacques.





"M. Shirk" <shirkdog_linux at ...125...>
Sent by: snort-users-admin at lists.sourceforge.net
10/26/2004 02:31 PM

 
        To:     snort-users at lists.sourceforge.net
        cc: 
        Subject:        RE: [Snort-users] only the "important stuff"


IDS matches signatures to network traffic on the wire. Someone could 
launch 
an attack against your servers, however, gain no access on them. These are 

not successful intrusions, just scans. I would be clear with your 
president 
about what he wants to see in a report.

Working with snort_on_acid, you could go through all the rule sets and 
look 
for obvious compromised traffic, such as back doors, ICMP and HTTP 
tunnels, 
as well as traffic that would only come from a server that has opened up a 

channel for an intruder to enter.

HOWEVER, now you have to take into account the applications on the servers 

for company. Lets say one snort sensor only has rules that would alert to 
a 
possibly compromised box. But, instead of a server being compromised, it 
has 
some web application, or database application running on bizarre ports. 
Now 
you have an automated alerting system to send email to the president. 
Instead of getting day-to-day alerts, he will be getting an important list 

of false positives. :-)

I second the notion of snort_on_acid, if your president wants only 
SUCCESSFUL intrusions, you will need to analyze the alerts and correlate 
them with host based intrusion technologies such as:

integrity checkers: aide/tripwire/osiris/samhaim
log files: syslog,secure,auth,messages
log monitors: swatch, tenshi
local *nix/Windows tools: netstat tcpview fport


Shirkdog



>From: SN ORT <snort_on_acid at ...131...>
>To: Snort Users 
><snort-users at lists.sourceforge.net>,steven.crandell at ...11827...
>Subject: RE: [Snort-users] only the "important stuff"
>Date: Tue, 26 Oct 2004 10:15:31 -0700 (PDT)
>
>What?! You mean, send him all of the positive alerts?
>  Impossible without human intervention/correlation.
>You could move some sensors back or set some variables
>that look at only important machines, or even setup
>another instance of Snort that runs only custom
>signatures you're sure never produce false
>positives/negative..etc, but then you could very well
>miss some legitimate break-ins. You could also try to
>customize the IDS so that each signature is customized
>to vulnerable servers. IOW, why would I want to
>receive an IIS vulnerability alert when my server is
>running apache? So I would set a var
>$apache_servers=IPaddress(range) and then set each
>Apache signature to destination = "$apache_servers",
>and at the same time have the IIS signatures only
>relate to IIS servers. Wow, there's a concept.
>
>
>Nah, you'd have to have a brain look at those first,
>and then send them to your presidente (although
>products like from ISS contain correlation
>capabilities)
>
>Cheese!
>
>Marc
>
>
>--__--__--
>
>Message: 9
>Date: Tue, 26 Oct 2004 09:34:56 -0700
>From: Steven Crandell <steven.crandell at ...11827...>
>Reply-To: Steven Crandell <steven.crandell at ...11827...>
>To: snort-users at lists.sourceforge.net
>Subject: [Snort-users] only the "important stuff"
>
>Hi all,
>
>I have snort running the way I want it to run, etc.
>I'm also using
>logcheck to watch the logs and email me when someone
>exceeds my
>thresholds.  Anyway, I'm pretty satisfied with how all
>of that is
>working.
>
>This morning the president of the co. has asked that
>he -not- receive
>the day to day alerts and would only like to receive
>alerts on
>"successful" intrusions.
>
>Are there certain rules that would never be triggered
>unless someone
>actually gets into a monitored system?  Or anything
>along those lines?
>
>I know this is a little off the wall, but any
>help/suggestions would
>be greatly appreciated.
>
>regards,
>--
>Steven Crandell
>steven.crandell at ...11827...
>
>
>
>
>__________________________________
>Do you Yahoo!?
>Yahoo! Mail Address AutoComplete - You start. We finish.
>http://promotions.yahoo.com/new_mail
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by:
>Sybase ASE Linux Express Edition - download now for FREE
>LinuxWorld Reader's Choice Award Winner for best database on Linux.
>http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users

_________________________________________________________________
FREE pop-up blocking with the new MSN Toolbar ? get it now! 
http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/



-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20041026/e9547b17/attachment.html>


More information about the Snort-users mailing list