Re: Prelude and Sguil capabilities

Hi Robin,

On Fri, 2006-11-10 at 16:42 +0100, Robin Gruyters wrote:
> Hi ya,
> 
> The last few weeks I've been playing with Sguil[1] and I must admit they
> have done some nice things with it:
> - "realtime" events;
> - analyze session data;
> - parse raw tcpdump files (for packets matching the req. sessions or save
>                            raw data for further analyze (ethereal))
> 
> Altough it has these features that Prelude doesn't have (except for saving
> session data, thanks to Frank van Vliet), it doesn't confince me to use it.
> What I dislike about it is:
> - the use of the GUI; 
>   You have to install different packages (tcl/tk) to view the data.
>   Also with all the little/narrow windows/panels, you can't really see the
>   overall alerts.
>   And thoses annoying errors/warnings from tcl/tk.
> - You have to connect to each sensor separately to view the alerts from each
>   sensor;
>   The problem with this is, you don't see the overall view of the alerts. So
>   if an intruder found and exploit on one of your servers, how far did the
>   intruder got through your network. 
>   To do this with Sguil, you have to connect to each sensor separatly, and
>   that to me is a big disadvantage.
> 
> What I want to do is try to implement some features from Sguil in
> Prelude/Prewikka:
> - semi-realtime events; (by using Javascripting)

If you get to work on this, please drop me a mail. I already have some
plan about it, so it would be nice to share our ideas concerning this
topic.

> - Save full packets in tcpdump format; (which we already have
>   up-and-running)

Modifying Snort so that it attach the full packet data, and having
Prewikka able to print the headers (as is currently done, but
differently) potentially sound like a good idea. 

Did you actually tried it? If you did, I'd like to hear about it.


> - Add more external command; (p0f, tcpdump, etc)

Since Prewikka 0.9.7, you can run any command out of Prewikka, so you
might want to check this out.


Regards,

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel