Re: network audit

Eckhardt, Rodolpho H. O. wrote:
> I would say Snort <www.snort.org> is a good choice!

It can also log into PostgreSQL and other databases.

I mention this since MySQL is rather weak on the advanced database features. You can probably define the joins yourself in your scripts (although some of mine do include some subselect clauses), but that's error prone and hard to maintain. With PostgreSQL and others, you can set up some views and have

PostgreSQL supports triggers, views, insertion rules, subselects, etc.. This makes the database much easier to work with since my views fold in the human-readable content, or compute some useful item.

Below are several sample views... I wish I had documented better what they're supposed to do. :-) I'm pretty sure 'snort1' creates a view that provides the event signature and frequency count. Snort2 is a view that can best be described as "ipevents," and snort3 is folds in a description of that event.

Bear

create view snort1 as

	select * from
		(select sig_id,count(*) from event join signature
			on event.signature=signature.sig_id group by sig_id) as f
		natural join signature -- adds rest of data
		natural join sig_class -- adds sig_class_name
	;

create view snort1b as
	select * from sig_reference
		natural join reference
		natural join reference_system
	;

create view snort2 as
	select * from event natural join iphdr;

create view snort3 as
	select * from
		event join signature
			on event.signature=signature.sig_id
		natural join sig_class -- adds sig_class_name
		natural join snort2
	;


-------------------------------------------------------------------

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek