[Snort-users] RE: Snort and Mysql for statistics purposes

Stark, John John.Stark at ...13162...
Wed Mar 9 16:58:47 EST 2005

Why don't you use the Base Project.


BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system. 

BASE is a web interface to perform analysis of intrusions that snort has detected on your network. It uses a user authentication and role-base system, so that you as the security admin can decide what and how much information each user can see. It also has a simple to use, web-based setup program for people not comfortable with editing files directly. 
BASE is supported by a group of volunteers. They are available to answer any questions you may have or help you out in setting up your system. They are also skilled in intrusion detection systems and make use of that knowledge in the development of BASE. 


John Stark, CISSP

-----Original Message-----
From: David Jiménez Domínguez [mailto:djdsecurity at ...11827...] 
Sent: Tuesday, March 08, 2005 5:05 PM
To: snort-users at lists.sourceforge.net; honeypots at ...35...; focus-ids at ...12665.....
Subject: Snort and Mysql for statistics purposes

Hi folks!

I need to graph all the traffic in my network (Top ports, Top src_ip, Top attacks) each 5 minutes...In the DataServer I have intalled Mysql and in the firewall I have installed snort-2.3.0 and I created just 4 rules to get all the tcp,udp,icmp and ip traffic in order to graph it with perl and rrdtool and post it in a web page....

Do you think it is the best way to do that???
Have your ever done something like that?? What tools do you recommend me??


More information about the Snort-users mailing list