RE: [sentinix-list] Email Notification from SnortCenter

 There are many many different ways of going about this, none of which I deem to be "simple". The goal here is too enable email alerting, triggered by certain events (snort rules) so an admin can have real-time alerts for a snort IDS system. I've located a number of scripts and/or programs that can accomplish this but most require a certain amount of re-configuring of the system or scripting/programming to make them worth while.

I've looked at "syslog-ng" whick takes a hell-of-alot of reconfiguring in a distributed IDS environment.

I've also looked at "snort-slinger"

http://www.venom600.org/code/SnortSlinger/

 And Ive often wondered why SnortCenter doesnt already have this feature in it... That team is probably too busy with AirSnort at the moment...

 Anyway, snortslinger looks like what Im going to go with, it seems to be the least labor intensive of the solutions Ive seen yet and has the most potential (bang-for-the-buck) and it queries a mysql database. We have a programmer currently working on some other projects in our shop but when he is available were hoping to get him to tweak something to meet our needs.

 If we get it worked out I'll post it to the list.

let me know if you come up with something else in the meantime.

thanks,
Michael

-----Original Message-----
From: "Terkanian, Greg" <[email protected]>
Sent: Feb 25, 2004 12:53 PM
To: The SENTINIX Mailing List <[email protected]>
Subject: RE: [sentinix-list] Email Notification from SnortCenter

You should search the list.  This was covered a couple weeks ago by MMorgan.


-----Original Message-----
From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
[mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of Lord Raiden
Sent: Wednesday, February 25, 2004 11:48 AM
To: [email protected]
Subject: [sentinix-list] Email Notification from SnortCenter


Hi all,

i installed sentinix on one of my boxes and this appliance is really fantastic. 

The only thing im missing (maybe i just havent found it) is some function that emails me certain alerts so i dont have to check each day for lets say mydoom/msblaster viruses on my network. 

If anybody could lead me into the right direction, if there is some solution out for my problem.


thanks in advance
_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix
_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix