We provide shared hosting, colocation services and server rental. We need
to enforce our AUP more proactively and detect malicious outgoing traffic
before we get complaints about it.
We are mirroring outgoing traffic for 3 quite large VLANS to a machine with
a GigE interface. The machine is running snort. I have not even come close
to figuring out which rules we want to load yet.
What I want to do to be able to generate a report on a regular basis looking
for all of our IP addresses that were the source of a triggered event and
report those events to the customer responsible for that server.
While BASE provides a good way of viewing whats in the snort database it
does not do what I need. I'm having a lot of trouble finding information on
reporting because the snort database, while optimized for speed, appears to
be quite complex.
On regular intervals I want to:
- Get all the source IP addresses and discard those that do not belong to us
since the last run
- For each IP address that has one or more event I want to list all the
events for that IP address
- I will then open a ticket on the responsible customer's account with this
information alerting them to the possibility of a policy violation or
security issue with their server.
Seems pretty straightforward but how can I get this information in a
readable report something like what is produced with the "Email Alert(s)
(full)" output included in BASE?
--
Landon Stewart
Superb Internet Corporation
Toll Free: 888-354-6128 x 4199 (US/Canada)
International: 604-638-2525 x 4199
CELEBRATING 10 YEARS OF HOSTING EXCELLENCE! 1996 - 2006
Web hosting and more "Ahead of the Rest": http://www.superb.net
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
