Re: [sentinix-list] Email Alert Notification?

Hi Michel,
 Thanks for the information, I'm looking at "swatch" and "2_swatch" currently. My approach disable the rules that generate the bulk of the "trash alerts" from my rulesets (the UDP chatter between my cisco switches and PDC for example). Then, enable the time delay in swatch for multiple events, say email one event every 10 minutes to avoid mail bombing my pager.

 Additionally, 2_swatch seems to have been developed to send "bulk summaries" of alerts instead of in real time. That may be something to look into.

 I was going to try and monitor very specific (catastrophic) events like "nessus scan detected" and/or reboots of the servers or services themselves at first.

 Of course, there will be a "how-to" document when its done.

Btw: the "How-to" regarding client/server setup of sentinix is complete (with a very basic html page), would you like me to mail it in?


Thanks,
Michael

-----Original Message-----
From: Michel Blomgren <[email protected]>
Sent: Feb 4, 2004 8:46 PM
To: The SENTINIX Mailing List <[email protected]>
Subject: Re: [sentinix-list] Email Alert Notification?

Although I have a cold right now and am a little blurry in my head, I think 
this is exactly something we're trying to achieve.

I started working on a layout to a Nagios plugin that'll catch snort alerts. I 
don't have any code yet, but it should (whenever finished) be able to catch 
alerts from a snort MySQL database, syslog and regular snort text logs.

The idea is really simple, I just don't (yet) have a good solution how to 
prevent that Nagios plugin to burp up snort alerts (as a default snort config 
usually generate lots of alerts once plugged in).  My idea now is to have 
something like e.g. "There are 23 new Snort alerts. Top alert is 'snort alert 
blablabla'.". E.g. if the number of alerts are above X it'll generate a 
warning, or above Y (a higher value than X), it'll generate a critical 
notification, i.e. snort has detected lots of funny stuff. If it's below X 
it's OK (X should of course be able to be set to 0).  I don't know if this is 
a good solution however, will have to look further into this. Any 
suggestions?

It's on my TODO list anyway.

	Michel

On Wednesday 04 February 2004 21:49, M. Morgan wrote:
> Greg,
>  Thats an interesting link but I should have been more specific in my
> request, I'm not sure if that would work for me as it relies on syslog
> files...
>
>  I have three remote snort sensors logging to a central mysql database. I'd
> like to configure notifications based on the events in that databse (or
> does it have to be on each seperate machine?)
>
>  This brings up some interesting questions for me:
> -when the output plugin is directing snort output to a remote database will
> a "log watcher" like swatch still work?
>
> -does snort log to the sys logs AND the remote database?
>
>  This is my first attempt at this trick and the options are many it seems
> but some work better than others.
>
> Any other ideas?
>
> Thanks for the help,
> Michael
>
> -----Original Message-----
> From: "Terkanian, Greg" <[email protected]>
> Sent: Feb 4, 2004 2:59 PM
> To: "M. Morgan" <[email protected]>,
> 	The SENTINIX Mailing List <[email protected]>
> Subject: RE: [sentinix-list] Email Alert Notification?
>
> Check out the following link:
> http://groups.google.com/groups?q=snort+email+notifications&hl=en&lr=lang_e
>n&ie=UTF-8&oe=UTF-8&selm=a2noie%241m1l%241%40FreeBSD.csie.NCTU.edu.tw&rnum=5
>
>
>
> -----Original Message-----
> From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> [mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
> Sent: Wednesday, February 04, 2004 1:50 PM
> To: [email protected]
> Subject: [sentinix-list] Email Alert Notification?
>
>
> Hello list,
>  Does anyone know of a tool that I can setup to send email notifications
> when I get certain alerts from my snort boxes?
>
> thanks,
> michael
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix

_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix