We have Snort in place and are looking for next steps.
Specifically, I think I am after documentation on best practices for using
snort, responding to alerts, predefined actions to evaluate or assess. We
are a credit card transaction processing company with 11 employees.
I might be after something like this for example:
Snort is actively listening for DOS attacks. If xxxx threshold is reached
we will be alerted by email. After investigation we will asses the
sitiuation and either: 1. Block traffic from that source and report the
attack to the service provider or 2. continue to monitor until the next
threshold is met, 3. etc...
I think we need to be able to tell our clients something other than we
monitor the alerts and respond as neccessary, and we don't have the
resources to have someone monitor this full time if you know what I mean.
Any suggestions on what everyone else is doing would also be benefitial, but
if there are any best practice guides please point me in the right
direction.
Thanks,
Daryl J. Rue
Network Manager
Crescent Systems
25 Main Place Suite 400
Council Bluffs, IA 51503
Phone: 712-388-2132 x205
Fax: 888-741-1648
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
