Snort alerts analysis (web interface)

Asked Apr 13 '15 at 10:06

Active Apr 13 '15 at 11:14

Viewed 636 times

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok).

The goal is to set up some web interface providing a way to view the whole TCP stream packets of each Snort alert. I'm interested in outgoing packets only. Say, I have to prevent my server from replying with a string "root:x:0:0". So, I add a rule:

reject tcp any any -> any any (content:"root:x:0:0"; flow:to_client; msg:"attack1_to_client"; sid:31337)

and get my alerts logged. Alert log is growing fairly quicky. And I have to find all unique request strings leading to /etc/passwd disclosure, and block all such string.

edited Apr 13 '15 at 11:14

asked Apr 13 '15 at 10:06

Hidden Name

What was your question? – schroeder Apr 13 '15 at 21:46
The question: are there any projects available to achieve my goals? – Hidden Name Apr 14 '15 at 09:35

Snort alerts analysis (web interface)

0 Answers0