|
Home > Archive > Snort > September 2004 > [Snort-users] Generating reports
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
[Snort-users] Generating reports
|
|
| Marie Severe 2004-09-22, 10:25 pm |
| Can anyone please give me advice on generating reports with Snort?
Currently, the default rules are giving me too much information. How can
I fine-tune Snort and generate reports which provide information and not
just an overload of data? Any help will be appreciated.
Thank you,
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
| |
| Alex Butcher, ISC/ISYS 2004-09-22, 10:25 pm |
|
--On 20 September 2004 16:57 -0400 Marie Severe
<Msevere@OasisAdvantage.com> wrote:
> Can anyone please give me advice on generating reports with Snort?
> Currently, the default rules are giving me too much information. How can
> I fine-tune Snort and generate reports which provide information and not
> just an overload of data? Any help will be appreciated.
I'll list my usual approach to tuning IDS rules:
1) disable rules that are too vague and only alert to *possible*
reconnaissance attempts.
2) for rules that are triggered legitimately by certain hosts (e.g. routers
generating SNMP traffic, etc), disable those rules for those hosts.
3) for rules that are still noisy, set thresholds.
> Thank you,
Best Regards,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
|
|
|
|
|