Thursday, February 16, 2006, 2:54:33 AM, you wrote:
|
>
|
On Feb 15, 2006, at 1:19 PM, Pablo Sanchez wrote:
Hi guys,
I know that almost everybody uses ACID, BASE and so on to check the snort logs and alerts. But I'm needing to develop my own interface for the snort database.
So I'd like to know if someone has already made some reports using the database.
I'm searching for SQL statements to make my own reports.
Example: Top 15 alerts, Top 15 services, Top 15 IP address attacked, and so on...
I'm also taking a look at the database schema. ( http://www.andrew.cmu.edu/user/rdanyliw/snort/snortdb/snortdb_schema.html ).
Best regards,
Pablo
Hi-
I am glad to hear that so many people use BASE.<grin> May I ask why you need to create your own interface? If it is a feature that needs to be added, it would probably be easier to just work with us to implement it?
If you still need to write your own, I would set up BASE and run it with the sql trace turned on. That way it will log every query that is run including the dynamic ones.
Hope that helps,
Kevin
---------------------
BASE Project Lead
http://sourceforge.net/projects/secureideas
http://base.secureideas.net
The next step in IDS analysis!
|
I didn't know about the base project, but i am using acid.
The same way you ask him why doesn't he help the base project instead of developping his own interface,
why did you fork the acid project ?
I couldn't find this informations on you web site
thanks
Mathieu CHATEAU
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
