Re: auto-response IDS againt port-scanning or attacked ip?

From: bladi <bladi-sec(at)novasec.es>
Date: Mon Jul 14 2003 - 21:00:14 EDT

Hi

I dont know if that exist yet for snort but I think you could do it easily using swatch, jwhois and some scripting.

But take care about de number of mails you send to the isp

That shows you how to setup Swatch to email you alerts http://www.theadamsfamily.net/~erek/snort/snort-swatch.conf.txt

bye

SB CH wrote:

> Hello, all.

---

NovaSec Servicios de Seguridad

C/ Evaristo San Miguel 4 2^(o)6 (Princesa) 28008 Madrid (Espan~a)

Tel: 91 547 30 51
Fax: 91 559 41 75
http://www.novasec.es

---

Is your IDS deployed correctly?
Find out by easily testing it with real-world attacks from CORE IMPACT. Go to www.coresecurity.com/promos/sf_eids1 to learn more.

---

Received on Wed Jul 16 21:30:23 2003