On Thursday 13 July 2006 19:17, Dan Brummer wrote:
I'm planning to put multiple sensors on my enterprise network
and have all of these feed to a central database server. From
my research I understand the best way to do this is have each
remote sensor send its Snort output using MySQL. Is this the best
way of doing this?
That's fine, just make sure you don't use database output from Snort
directly. Use unified output and then some tool like Barnyard to do the
database stuff. Why and how is explained in the docs and misc install
guides.
What about the rules and and making sure they're shared and
up-to-date on all the sensors?
If you're comfortable with some simple scripting, it's pretty much
trivial to setup Oinkmaster in a distributed environment to manage the
configs and rules. The Oinkmaster FAQ may give some tips:
http://oinkmaster.cvs.sourceforge.net/oinkmaster/oinkmaster/FAQ?view=markup
You may also want to check out the other tools at
http://www.snort.org/dl/contrib/
Do I need to be running snort on the
central database server if all it's doing is receiving sensor outputs
and displaying reports using ACID or BASE?
No need to run Snort there unless you use the same box as a sensor
(which you shouldn't). Don't even think about running ACID, it was
abandoned about 50 years ago.
/Andreas
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
