6.5 Using Snort More Effectively | Managing Security with Snort and IDS Tools

It doesn't take long before only logging to the alert file becomes ineffective. The alerts scroll by too quickly and making sense of the data logged in a timely manner can be impossible. In Chapter 5, we looked at how to configure Snort to log to a database. The information sent to the database contains an incredible amount of information including details about the packet that triggered the alert. Refer to Appendix A for details on the data contained in the database. Choose a database and configure Snort to send alerts to it.

Once the data is in the database, you need to choose some tools that can present the data in a way that makes managing the alerts and the sensors quick and easy. I prefer to use ACID (the Analysis Console for Intrusion Detection). You may find that another tool suits you better. Refer to Chapter 10, Chapter 11, and Chapter 12 for an examination of the tools that are available to help you manage your Snort-based NIDS deployment. Chapter 7 discusses strategies to keep your signatures up-to-date and effective.

Table of content

Managing Security with Snort and IDS Tools

ISBN: 0596006616
EAN: 2147483647

Year: 2006
Pages: 136

Authors: Christopher Gerg, Kerry J. Cox

BUY ON AMAZON

Crystal Reports 9 on Oracle (Database Professionals)

Project Management JumpStart

Agile Project Management: Creating Innovative Products (2nd Edition)

Beginning Cryptography with Java

Junos Cookbook (Cookbooks (OReilly))

Comparing, Designing, and Deploying VPNs