RE: [Snort-users] mail notification

=20
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

First for the drinking,
http://www.theadamsfamily.net/~erek/...nking_game.txt


Then for the docs=20

http://www.snort.org/docs/FAQ.txt

=20
5.9 How do I get snort to e-mail me alerts?

You can't. Such a process would slow Snort down too much to make it
of any use.
Instead, log to syslog and use swatch or logcheck to parse over the
plaintext
logfiles.

With the logsurfer docs, this might get you on the road to doing
something with
snort & logsurfer:

http://www.obfuscation.org/emf/logsurfer/snort.txt

JASON HAAR provided an example Swatch (3.1beta) config that emails
alerts:

http://www.theadamsfamily.net/~erek/...watch.conf.txt

Here are some docs on swatch:

* http://www.oit.ucsb.edu/~eta/swatch/
* http://www.stanford.edu/~atkins/swatch
* http://rr.sans.org/sysadmin/swatch.php
* http://www.enteract.com/~lspitz/swatch.html
*
http://www.cert.org/security-improve...s/i042.01.html

IDS Center (see FAQ 5) on Win32 will also mail alerts.

=20
- -----Original Message-----
From: Esler, Joel - Contractor [mailto:joel.esler@rcert-s.army.mil]=20
Sent: Tuesday, December 21, 2004 11:59 AM
To: snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] mail notification

You don't use acid for this, you can use..
http://swatch.sourceforge.net/

Swatch.

- -----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Esler,
Joel - Contractor
Sent: Tuesday, December 21, 2004 12:45 PM
To: snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] mail notification


How many drinks is this? Anyone know?

- -----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Jimmy
Hayes
Sent: Tuesday, December 21, 2004 12:37 PM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] mail notification


Hello I just finished installing snort Version 2.2.0 (Build 30) with
mysql database and ACID.

My question is, I can see some alerts by going to my ACID site, but
is
there a way or an option on snort so That I can e-mail me when an
alert
is triggered? I tried looking in the manual but didn't find anything.

thanks



- -------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real
users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=3Dort-users


- -------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real
users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=3Dort-users


- -------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real
users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=BEort-users



-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQchmzJiWafDb7+B/EQLwdwCg2XpZZECREclRgMIeodMdf/lw9DwAoMig
QloE5IqUcx1bWPwYH6cTj+qJ
=3Dzb8A
-----END PGP SIGNATURE-----




Disclaimer:
This electronic message, including any attachments, is confidential and int=
ended solely for use of the intended recipient(s). This message may contain=
information that is privileged or otherwise protected from disclosure by a=
pplicable law. Any unauthorized disclosure, dissemination, use or reproduct=
ion is strictly prohibited. If you have received this message in error, ple=
ase delete it and notify the sender immediately.=20





-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users