[Snort-users] "Best of breed" tools for Snort

Paul Schmehl pauls at ...6838...
Fri Apr 22 10:36:13 EDT 2005


--On Friday, April 22, 2005 09:56:58 AM -0600 Tristan RHODES 
<TristanRhodes at ...13277...> wrote:

> 1.  I would like to implement several (around 8) Snort sensors in our
> network.
>
> 2.  I would like the rulesets/signatures to be updated automatically
> (or with a simple manual process).
> IDS Policy Manager
> Oinkmaster
> SnortCenter2 (What does this do?  I cannot find good documentation on
> it.)
> Others?
>
Oinkmaster.

> 3.  I would like tools to analyze the data and send alerts.
> Base
> SecureMine for Snort  (I wish it was not Windows based)
> (Can both of these tools be used on the same data?)
>
Yes.

> 4.  What data architecture is best?  For instance, would it be best to
> have a central database server?

With your setup, yes, but you're going to have to watch the growth of the 
db, because it will slow down response times as the event count grows.

>  Briefly explain the data flows.

snort -> unified logs -> barnyard (essential for what you want to do) -> db
>
> 5.  What are the best tools for each of these processes?  Any other
> recommendations?
>
What OS do you plan on using?

Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu




More information about the Snort-users mailing list