Apparently this person only wants reports AFTER the intrusion. Okay... be
thankful that s/he
will only know post-facto and will not be 'riding' you during a stressful
time of hunting and
intense blocking. --of course that just one way to look at this :-)
-jacques.
"M. Shirk" <shirkdog_linux@hotmail.com>
Sent by: snort-users-admin@lists.sourceforge.net
10/26/2004 02:31 PM
To: snort-users@lists.sourceforge.net
cc:
Subject: RE: [Snort-users] only the "important stuff"
IDS matches signatures to network traffic on the wire. Someone could
launch
an attack against your servers, however, gain no access on them. These are
not successful intrusions, just scans. I would be clear with your
president
about what he wants to see in a report.
Working with snort_on_acid, you could go through all the rule sets and
look
for obvious compromised traffic, such as back doors, ICMP and HTTP
tunnels,
as well as traffic that would only come from a server that has opened up a
channel for an intruder to enter.
HOWEVER, now you have to take into account the applications on the servers
for company. Lets say one snort sensor only has rules that would alert to
a
possibly compromised box. But, instead of a server being compromised, it
has
some web application, or database application running on bizarre ports.
Now
you have an automated alerting system to send email to the president.
Instead of getting day-to-day alerts, he will be getting an important list
of false positives. :-)
I second the notion of snort_on_acid, if your president wants only
SUCCESSFUL intrusions, you will need to analyze the alerts and correlate
them with host based intrusion technologies such as:
integrity checkers: aide/tripwire/osiris/samhaim
log files: syslog,secure,auth,messages
log monitors: swatch, tenshi
local *nix/Windows tools: netstat tcpview fport
Shirkdog
From: SN ORT <snort_on_acid@yahoo.com>
To: Snort Users
<snort-users@lists.sourceforge.net>,steven.crandell@gmail.com
Subject: RE: [Snort-users] only the "important stuff"
Date: Tue, 26 Oct 2004 10:15:31 -0700 (PDT)
What?! You mean, send him all of the positive alerts?
Impossible without human intervention/correlation.
You could move some sensors back or set some variables
that look at only important machines, or even setup
another instance of Snort that runs only custom
signatures you're sure never produce false
positives/negative..etc, but then you could very well
miss some legitimate break-ins. You could also try to
customize the IDS so that each signature is customized
to vulnerable servers. IOW, why would I want to
receive an IIS vulnerability alert when my server is
running apache? So I would set a var
$apache_servers=IPaddress(range) and then set each
Apache signature to destination = "$apache_servers",
and at the same time have the IIS signatures only
relate to IIS servers. Wow, there's a concept.
Nah, you'd have to have a brain look at those first,
and then send them to your presidente (although
products like from ISS contain correlation
capabilities)
Cheese!
Marc
--__--__--
Message: 9
Date: Tue, 26 Oct 2004 09:34:56 -0700
From: Steven Crandell <steven.crandell@gmail.com>
Reply-To: Steven Crandell <steven.crandell@gmail.com>
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] only the "important stuff"
Hi all,
I have snort running the way I want it to run, etc.
I'm also using
logcheck to watch the logs and email me when someone
exceeds my
thresholds. Anyway, I'm pretty satisfied with how all
of that is
working.
This morning the president of the co. has asked that
he -not- receive
the day to day alerts and would only like to receive
alerts on
"successful" intrusions.
Are there certain rules that would never be triggered
unless someone
actually gets into a monitored system? Or anything
along those lines?
I know this is a little off the wall, but any
help/suggestions would
be greatly appreciated.
regards,
--
Steven Crandell
steven.crandell@gmail.com
__________________________________
Do you Yahoo!?
Yahoo! Mail Address AutoComplete - You start. We finish.
http://promotions.yahoo.com/new_mail
-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
_________________________________________________________________
FREE pop-up blocking with the new MSN Toolbar ? get it now!
http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/
-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
