License: Other Open Source License Updated: October 23, 2001 Source: Source Available
This version has PostgreSQL and SSL (OpenSSL) support compiled in which means you can log the Snort output to a PostgreSQL database. You can then run an SQL query to produce output similar to DEMARC. I've started writing a BeOS GUI which will produce similar output to DEMARC. A sneak preview is here and here.
This uses a module details of which can be found here.
I'll have a BeOS oriented version of the above here soon.
License: Other Open Source License Updated: September 15, 2001 Source: Source Available
Fixed the package installation to correctly create /var/log/snort which is where the logs will go if you don't specify a location on the command line.
The previous version was actually 1.8.1 anyway.
I also added in the vision rules and conf from www.whitehats.com which has a different set of rules to the default.
If you want to use the vision rules, ./snort -Afull -c vision.conf will get you working. You'll have to edit the vision.conf file to add in your network.
The default way to start Snort is ./snort -Afull -c snort.conf
This version of Snort for BeOS BONE has PostgreSQL support compiled in. This means that you can log the data to a database and then write SQL queries to retrieve that data.
Included in this zip file is a file called create_sybase which contains all of the SQL required to create the Sybase tables and indexes.
If you know Sybase or MS SQL Server then you'll know what to do with this file. If you run SQSH, open this file in StyleEdit, copy all, and paste it into SQSH.
So far it is running fine, so i am going to have to enable Sybase and Microsoft SQL Server support in SnortMonitor now..... ;-)
Snort Config/resource file
You will have to edit your .snortrc file or snort.conf file and add in this line:
output database: log, sybase, host=snort user=youruserid password=yourpassword dbname=snort sensor_name=tcp/ip_address_of_your_pc detail=full
The order of this is important because it will crash if you don't have it in the above order
Please email me any bugs.
Version 1.8.7
License: Other Open Source License Updated: July 21, 2002 Source: Source Available
This is the first version of Snort which supports Sybase. There is already Microsoft SQL Server support, but not using FreeTDS, so this release is i guess a "landmark release" for Snort and FreeTDS :-)
