- Adding the ACID user account
- Adding the usrlocallib line
- Adding Visuals and Getting Reports
- Advanced options and deep dark secrets
- Aertfu
- Aiertjfast
- Alerting modules
- Alertsyslog
- An indepth rule structure
- Apache and PHP on Linux
- Atert information cache
- Atert output
- Back Orifice bo
- Backing up everything
- Backing up your production environment
- Barnyard commandline switches
- Barnyard for Fast Output
- Benign alerts
- Blocking malicious network traffic with Snort Sam
- Building a rule from whole cloth
- Cataloging your network
- CDROM Considerations
- Checking an attack with ACID
- Checking the installation
- Checking your work
- Choosing your preprocessors
- Choosing your Windows OS
- Classification
- Classificationconfig
- Coming up with an action plan
- Compile from source code or install a binary
- Compiling and installing MySQL
- Compiling the code
- Configuration declarations
- Configure the conf file
- Configuring and running stunnel as a server
- Configuring Oinkmaster - 2
- Configuring Servers variables
- Configuring Snort
- Configuring Snort as a Service
- Configuring Snort for Snort Sam
- Configuring Swatch
- Configuring the Snort Sam agent for your firewall
- Configuring the system for Snort logs
- Contents at a Glance
- Create the ACID sonsole Web site in IIS
- Creating Snorts user accounts
- Data storage
- Database
- Database outputs
- Defining network Variables
- Defining other operating Variables
- Defining preprocessing
- Detecting anomalies
- Developing an Incident Response Plan
- Digging in SQL guts
- Disabling services in Debian GNULinux
- Disabling services in Gentoo Linux
- Disabling services in Red Hat Linux
- Doing the installation and configuration
- Downloading and compiling Snort
- Downloading and installing Snort Sam
- Downloading and installing Swatch
- Downloading and installing syslogng
- Drilldown information
- Edit the ACID configuration file
- Elements of the rule body
- Enablesid options
- Enabling rules rules rules
- Experimental preprocessors
- Extracting the files
- Filling Your Farm with Pigs
- Firewalling Suspicious Traffic in Real Time
- Fitting In Snort
- For Linux
- Gathering the necessary files
- General options
- Getting and installing stunnel
- Getting it all running for real
- Getting the client system ready for the
- Getting the server ready for the job
- Getting to ADODB for Linux
- Getting to Know Snort and Intrusion Detection
- Getting your hands dirty with stunnelconf
- Giving the ACID user account its proper database permissions
- Graphing and reporting
- Harden the OS
- Houston We Have an Incident
- How does Snort deal with all those rules
- How the rules files are organized
- In This Chapter - 2 3
- Index
- Installation
- Installing and Configuring Barnyard
- Installing GD dependencies to go with PHP on Linux
- Installing JpGraph on Linux
- Installing JpGraph on Windows
- Installing MySQL
- Installing MySQL from source code
- Installing MySQL goodies from the Linux package
- Installing Oinkmaster
- Installing PHP for Apache on Linux
- Installing PHPlot on Windows
- Installing Snort and MySQL for Windows
- Installing Snort as a service
- Installing Snort for Linux
- Integrating Snort into Your Security Strategy
- Internet Information Services IIS on Windows
- Introduction
- IP address cache
- Is this thing on - 2
- Keeping Snort Up to Date
- Keeping your logs safe
- Keeping Your Windows Locked
- Knowing what to look for in your logs
- Launch Snort on the client
- Launch stunnel on the client
- Learning from the Attack
- Limit physical access
- Locating Unix and Linux logs
- Logging modules
- Logging to a database
- Logging to a database and syslog
- Looking for Odd Files
- Looking for Odd Network Services
- Looking for Odd Running Processes
- Looking Up Snorts Nose
- Maintenance
- Making adjustments
- Malicious alerts
- MD5 hash
- Meta information
- Modifysid options
- Multiple hosts
- Multiple output configuration
- MySQL
- MySQL your SQL
- Net Work settings
- Network Based IDS
- Normalizing network traffic
- Obtaining more information on an alert
- Output plugins
- Packet Logger
- Partition configuration
- PGP and hashing accept no substitutes
- Physical security
- Picking apart the snortconf file
- Pigs on the Perimeter
- Platforms and dependencies
- Playing by the rules
- Point a browser at it
- Popping in the binary
- Portscan portscan2 conversation
- Postgres
- Preparing your system for MySQL
- Preparing your system for Snort
- Protocols
- Pulling the power plug
- Putting the network plug
- Reacting in Real Time
- Readying Your Preflight Checklist
- Recovering from the Incident
- Referenceconfig
- Rpcdecode a preprocessor for RPC connections
- Rule actions
- Rules rules rules
- Running Oinkmaster
- Running Snort and stunnel
- Scanning your network
- Securing Snorts Output
- Securing the SSH Daemon
- Setting network variables
- Setting up a Snort sensor for an internal network
- Setting up ADODB for Windows
- Setting up libpcap
- Setting up PHP on the Windows platform
- Setting up the archive database tables
- Setting up the client in stunnelconf
- Setting up the myini fife
- Setting up the snort database tables
- Single IP address
- Skipfile configuration option
- Snapshot views
- Sniffer mode
- Snort
- Snort logging to a database
- Snort sensor in the DMZ
- Snorting through Logs and Alerts
- Snorts output facilities
- Snorts Output Modules
- Sourcedestination
- Starting Swatch
- Starting up Snort at boot time
- Table of Contents
- TCP and UDP protocol information
- Telnetdecode a preprocessor for telnet sessions
- Test Snorts output
- The Basics
- The content option
- The depth option
- The frag2 preprocessor
- The Freshmeatnet Web Site
- The Graph Alert data page
- The gruesome guts of the configuration file
- The layout of the rule body
- The main ACID console page
- The nocase option
- The offset option
- The Power of the
- The Snort Mailing Lists
- The Snortorg Web Site
- The stream4 preprocessor
- The Uniform Resource Identifier URI option
- The Windows Snort IDS
- Tighten OS access control
- Time for a Snort
- Trimming the fat
- Two resource hogs Windows and Snort
- Understanding the benefits of preprocessing
- Unified logging
- Unified togging with Snort
- Updating Rules with Oinkmaster
- Using a security audit tool
- Using ACID to View Snort Alerts
- Using ogjtcpdump
- Using the Meta IP Protocol and Payload information
- Using the source
- Using Windows Event Viewer
- Viewing processes in Windows
- What does Barnyard do
- What does it do - 2
- Whats cool about it - 2 3
- Whats on the CDROM
- Where does it go
- Wildcards
- Your syslogngconf file