[Snort-users] Re: ACID/BASE vs PRELUDE
ktk at ...10113...
Mon Sep 19 14:31:15 EDT 2005
> Has anyone done a good comparision between BASE
>(http://secureideas.sourceforge.net/) and Prelude
>(http://www.prelude-ids.org/) as a managment console for Snort ?
We set up Prelude to funnel the output from several Snort sensors into a
backend DB (MySQL) from which we used Prewikka (the python-based display
engine) for viewing. Prewikka is very nice in concept, filters work
well, does a decent job of organizing data visually using color-coding.
The Prelude-Manager is, I think, the best part of Prelude; it allows
data from various sensors to be aggregated, stored, and sent upstream to
either another aggregator or else into a database for display. (This is
nearly identical to the "event collector" that we used in our ISS
Back to Prewikka for a moment... I'd prefer an interface that shows
aggregate counts in descending order of severity, with an ability to
drill-down by src/dst network/address and, eventually, down to
individual discrete events. Prewikka instead shows all events in the
order in which they were received, but allows you to apply filters if
you have some clue of what you're looking for.
On the negative side, Prelude-Manager's DB has serious performance
issues that need to be addressed. The fundamental limiting factor is
its schema, which puts most forms of data into a single table, along
with a tag that identifies the nature of the item. Just pulling up one
screenful of log data (50 signatures) could take several minutes.
Profiling to see where the bottleneck was shows MySQL fielding some 500+
queries per second to satisfy just that one page view. If you pull up a
thousand entries, for example, you might as well go out for lunch.
More information about the Snort-users