Re: open source artificial ignorance-like systems

Hmm, what's wrong with "grep -v" for artificial ignorance?

>Like always ignore xyz.*,
> ignore abcd.* unless it happens more than X times in Y time frame

Well, SEC can do this one ...

Also, I wouldn't blindly auto-populate the library of things to ignore
- just because something happens 5000 times the first time it does,
doesn't mean its benign :-)




On 4/17/07, Chris Buechler <[email protected]> wrote:
> Likely everyone here has read MJR's artificial ignorance guide, but just
> in case you haven't:
> http://www.ranum.com/security/computer_security/papers/ai/index.html
>
> What I've spent a lot of time looking for, with no success, is an open
> source system that will implement something similar but smarter than a
> simple grep from cron. What I ideally want is something that reads logs
> in real time, and has a list of "rules", if you will, which would be a
> list of regex's with an action for each. Like always ignore xyz.*,
> ignore abcd.* unless it happens more than X times in Y time frame
> (minutes, hours), etc. and a default alert rule for anything that
> doesn't match any of the previous rules, since it's something I'm not
> expecting.
>
> Seems pretty simple, but a lot of searching and browsing loganalysis.org
> and similar sites has left me with nothing. I could hack together
> something with standard Unix tools that would meet most of these
> requirements. But I figure as simple and useful as this is, somebody has
> probably already put together an open source package that does what I
> describe, I just can't find it.
>
> Any suggestions would be appreciated. OS, if it matters, could be either
> FreeBSD or Linux.
>
> Cheers,
> Chris
>
> _______________________________________________
> LogAnalysis mailing list
> [email protected]
> http://www.loganalysis.org/mailman/listinfo/loganalysis
>


-- 
Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA
      http://www.chuvakin.org
  http://chuvakin.blogspot.com
    http://www.info-secure.org