Tool for mining argus flow data + with prelude support

I've been working on migrating some of the commands I currently run on my
Argus flow data (http://qosient.com/argus/), into one perl script that also
has the ability to send its alerts into Prelude.  It is called
argusminer.pland version
0.1 is available at http://ribwich.bitparser.com.  Thanks to all the Prelude
developers who have been working on the easy bindings, as it made the
Prelude output option possible for me.  I'm still working on migrating tasks
that I currently run manually, etc., but figured I would put what I have
done, up for download - in case people had comments, suggestions, or would
otherwise find it useful.  All of the data mines are not necessarily
"traditional alerts", but having them in Prelude I find helps in the IR and
event verification processes.

* argus 3.x clients are needed and either installed in the default
/usr/local, or symlinks created
* tested with perl 5.8.5
* you'll need Net::CIDR::Lite & Getopt::Long.  In addition, PreludeEasy if
outputting to prelude.
* to use prelude output, you'll need libprelude configured with easy
bindings (currently in svn)
* when used with prelude output, it is a one-off agent, in that it does not
stay connected - it connects when you run argusminer.pl on a file, sends its
alerts to prelude, then disconnects.
* for detailed information, use 'perldoc argusminer.pl', or for just the
necessities: argusminer.pl --help
* you probably want to output to the console (which is the default) first,
to get an idea of what output you will see on your flow files


Hope this is useful to someone,

Scott
_______________________________________________
Prelude-user site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-user