Why don't you use the Base Project.
BASE
BASE is the Basic Analysis and Security Engine. It is based on the code from
the Analysis Console for Intrusion Databases (ACID) project. This application
provides a web front-end to query and analyze the alerts coming from a SNORT
IDS system.
--------------------------------------------------------------------------------
BASE is a web interface to perform analysis of intrusions that snort has
detected on your network. It uses a user authentication and role-base system,
so that you as the security admin can decide what and how much information each
user can see. It also has a simple to use, web-based setup program for people
not comfortable with editing files directly.
--------------------------------------------------------------------------------
BASE is supported by a group of volunteers. They are available to answer any
questions you may have or help you out in setting up your system. They are also
skilled in intrusion detection systems and make use of that knowledge in the
development of BASE.
http://secureideas.sourceforge.net/links.php
John Stark, CISSP
-----Original Message-----
From: David Jiménez Domínguez [mailto:djdsecurity@gmail.com]
Sent: Tuesday, March 08, 2005 5:05 PM
To: snort-users@lists.sourceforge.net; honeypots@securityfocus.com;
focus-ids@securityfocus.com
Subject: Snort and Mysql for statistics purposes
Hi folks!
I need to graph all the traffic in my network (Top ports, Top src_ip, Top
attacks) each 5 minutes...In the DataServer I have intalled Mysql and in the
firewall I have installed snort-2.3.0 and I created just 4 rules to get all the
tcp,udp,icmp and ip traffic in order to graph it with perl and rrdtool and post
it in a web page....
Do you think it is the best way to do that???
Have your ever done something like that?? What tools do you recommend me??
Regards
DJ
--------------------------------------------------
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_ide95&alloc_id396&opÌk
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
