Re: [sentinix-list] Clearing snort database
Michel Blomgren <[email protected]>
| Newsgroups | gmane.linux.sentinix |
|---|---|
| Message-ID | <[email protected]> |
On Thursday 18 December 2003 17:42, Marlon.Richards-5I9FqcT3+DFWk0Htik3J/[email protected] wrote: > Hi. > My database has so many alerts that it has become impossible for me to go > through everything. How can i clear the database and then begin to limit The easiest way to do it is to enter ACID (from SnortCenter, "alert console") and choose to see all alerts (not only TCP, UDP, etc. but everything) then on the bottom, choose "delete" "entire queue" (or something). If it's really many alerts (several hundered MB worth, or even GB) it may take a few minutes (depending on your hardware). > the amount of data being collected? I figure i should be able to deactivate > some of the rules but is there anything else that i can do to keep the > entries in my database manageable? Keep the alerts to nill (or bare minimum), if you don't you'll have a hard time discovering real attacks. A few alerts (<5) a week, if possible, is a good goal, as long as you still track what you want to track, i.e. if you get Blaster-D activity (CyberKit icmp stuff) on your net, you might want to keep those alerts in there anyway (or why not filter out those bad ICMP packets in the firewall?). Take a look at your most common alerts, get their sid (the [snort] link in the ACID alert listing) and disable them by removing them from following a policy in the SnortCenter rules listing (you can not disable them if they follow a policy, you must remove them from following a policy first). Also: SnortCenter should _only_ be used in Mozilla, Netscape 6.x or Mozilla Firebird, MSIE works but not perfectly. Michel > > Regards > > > > > ==================================== > Marlon Richards > Communications Engineer > West Indies Alumina Company > Kirkvine Works > Jamaica > Tel#: 876-961-7434 > Fax#: 876-961-7464 > Email: marlon.richards-Rzeo2xivIqhWk0Htik3J/[email protected] > > _______________________________________________ > SENTINIX mailing list > [email protected] > http://elevenprospect.com/mailman/listinfo/sentinix