I agree with Wes. We use OpenAanval for more "real-time" monitoring, and the
ability to conduct investigations of events by attaching notes to Collection
Groups and sending simple email alerts. However, BASE has much more granular
search capabilities, and it is possible to import an entire query into an AG
and then report on it. We use this for doing weekly/monthly malware counts,
searching on the signature "roughly" equaling "malware" (from Bleeding Snort
sigs).
--Dave
-----------------------------
Dave Shackleford, CISSP
Information Security Architect
Norfolk Southern Corp.
(404)962-5620
david.shackleford@nscorp.com
-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Wes Young
Sent: Monday, January 31, 2005 8:58 AM
To: Chris Vaughan
Cc: Dave C; snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] ACID Dates
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I run them both, I don't think either one is better than the other, they
both have very powerful features.. Aanval has a great way of managing alerts
and sifting through large amounts of data, but it has problems extracting
data into emails etc... this is where I think BASE can play a very good role
with it's alert groups etc.... IMO running both simultainiously will give
you a very powerful combo.....
Chris Vaughan wrote:
| I looked at the website, and it looks a lot like ACID.
|
| What do you like about BASE so much more? What are it's advantages
over ACID? What about compared to OpenAanval?
|
| -----Original Message-----
| From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Dave C
| Sent: Wednesday, January 26, 2005 6:17 PM
| To: snort-users@lists.sourceforge.net
| Subject: Re: [Snort-users] ACID Dates
|
| Dump ACID and use BASE
| http://secureideas.sourceforge.net/
|
| ----- Original Message -----
| From: "James M. Driskell" <jdriskell@ups.edu>
| To: <snort-users@lists.sourceforge.net>
| Sent: Wednesday, January 26, 2005 4:50 PM
| Subject: [Snort-users] ACID Dates
|
|
|
|>Hello List,
|>
|>I was running some Snort reports this morning using the ACID interface
and
|>I
|>noticed that the drop-down year selection window only goes up to 2004.
|>I'm
|>using ACID v0.9.6b23. Any ideas on how to fix this?
|>
|>Thanks,
|>
|>Jim Driskell
|>
|
|
|
|
|
| -------------------------------------------------------
| This SF.Net email is sponsored by: IntelliVIEW -- Interactive
| Reporting Tool for open source databases. Create drag-&-drop reports.
| Save time by over 75%! Publish reports on the web. Export to DOC, XLS,
RTF, etc.
| Download a FREE copy at http://www.intelliview.com/go/osdn_nl
| _______________________________________________
| Snort-users mailing list
| Snort-users@lists.sourceforge.net
| Go to this URL to change user options or unsubscribe:
| https://lists.sourceforge.net/lists/listinfo/snort-users
| Snort-users list archive:
| http://www.geocrawler.com/redir-sf.php3?list=snort-users
|
|
|
|
| -------------------------------------------------------
| This SF.Net email is sponsored by: IntelliVIEW -- Interactive
| Reporting Tool for open source databases. Create drag-&-drop reports.
| Save time by over 75%! Publish reports on the web. Export to DOC, XLS,
RTF, etc.
| Download a FREE copy at http://www.intelliview.com/go/osdn_nl
| _______________________________________________
| Snort-users mailing list
| Snort-users@lists.sourceforge.net
| Go to this URL to change user options or unsubscribe:
| https://lists.sourceforge.net/lists/listinfo/snort-users
| Snort-users list archive:
| http://www.geocrawler.com/redir-sf.php3?list=ort-users
|
|
- --
Wes Young
Network Secuity Analyst
University at Buffalo
GPG Key: http://saxjazman9-security.blogspot.com/2005/01/gpg-key.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
iD8DBQFB/jlP1M5o0FsrrbERAqyDAJ981klq6LR4eI8FlLdSKGdZV0+axQCfXvQ5
xhTy7RwyfYvtHFAyxhpPafY=
=21HH
-----END PGP SIGNATURE-----
-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting Tool
for open source databases. Create drag-&-drop reports. Save time by over
75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
