Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

BASE is an improvement over ACID, but it's easy to tell that it's maintained by someone who doesn't use it. There's no at-a-glance overview of network activity like you get with McAfee's NUBA IDS and many others, and searching for patterns is awkward and slow compared to log aggregators like Splunk.

I'm aware of a few alternatives to BASE:

  • Sguil gives a somewhat nicer view of events, but it's showing its age, and the tcl/tk interface is awkward to use on a remote set of snort sensors from a Windows desktop.

  • OSSIM provides some pretty charts, but it wants to be your top-level SIEM in a single package, and I need something more modular, configurable, and network-focused than that.

  • Snorby looks intriguing, but it's the one out of the bunch that I haven't even tried installing and using yet; the demo site hasn't worked for me from my work desktop; only at home.

share|improve this question
2  
I can login into snorby without any problem. –  Nicolas NOEL Feb 7 '11 at 14:23
    
What kind of EPS are you seeing? –  Scott Pack Feb 7 '11 at 14:50
    
It may be the browsers here at work, or something--I went out and tried it on my iPhone, and could log in ok. Not sure what EPS means in this context. –  user502 Feb 7 '11 at 16:03
1  
@user502 EPS==Events per Second, basically how quickly are alerts generated. The choice of product can depend a lot on how chatty and/or how many sensors you have. –  Scott Pack Feb 7 '11 at 16:43
    
Thanks. Probably not going to go much over 1-2EPS. –  user502 Feb 7 '11 at 17:41
show 1 more comment

3 Answers

up vote 8 down vote accepted

"and the demo website wouldn't let me log on, which doesn't engender extreme confidence" ouch.. I am the developer of Snorby and i'll bet 100 USD you were typing "snorby@snorby.com" (try .org). I have never had one issue with authentication or demo downtime since the launch of Snorby 2.x.x. Please make sure you verify credentials thoroughly before you post negative comments about a project to a large audience.

Aside from Snorby I would recommend Sguil. Sguil offers full packet capture, session data and numerous other powerful features. A bad UI is a small price to pay for valuable data.

share|improve this answer
2  
I apologize for blaming the issue on snorby in a public forum without checking it from another location. You'd lose your $100 (i.imgur.com/luwkh.jpg), but the honor of your project remains intact; I'm editing the post to reflect that. –  user502 Feb 9 '11 at 13:46
2  
That's odd. I have never seen a basic-auth dialog for Snorby outside of the fullpacket capture authentication and session timeouts. (and I wrote the software.. just saying) You have something horribly wrong (client-side) and also Snorby does not support ie6,7 or 8. p.s You may want to try a more secure/feature rich browser. Snorby uses a lot of html5/css3 you are missing out. I figured most people would be using firefox or a webkit browser. I should better document that and will (thanks). –  mephux Feb 11 '11 at 16:03
1  
At work, I need special dispensation to install anything besides IE7. After getting that dispensation (and firefox) both demo.snorby.org and the local insta-snorby experiment seem to work perfectly. It certainly makes sense not to deal with the IE headache when developing a webapp, but a failover message about IE nonsupport on the default page would be cool. –  user502 Feb 22 '11 at 20:00
    
Snorby seems to depend on versions of other programs more recent than are included in common distros' package managers. When the program is also one that's a severe dependency hell to install from source, like ImageMagick, this presents a bit of a barrier to entry. Insta-snorby is nice, but doesn't come in 64 bits, so I'm stuck back with BASE again :( –  user502 Mar 29 '11 at 18:57
    
plug SecurityOnion is a great way to try out Snorby and many other NSM / network analysis tools. It is 64bit and if you already have Ubuntu you can use their PPAs to shortcut a full install. Main site is securityonion.blogspot.com –  adric Aug 7 '13 at 13:46
add comment

I'm using Aanval ®. New in Aanval v7 is its unique Situational Awareness engine, which provides in-depth event and architecture analysis of the host network. In some cases it's better than BASE, it's a little SIEM, but i use it along side with BASE and Snorby.

share|improve this answer
add comment

if you have enough money in your pocket or less than 500mb (but bewar: in case of an attack and lots&lots of logfiles splunk may deactivate its parsing if you overrun your limits for a certain time)

splunk for snort

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.