I have installed snort and I want to use the swatch tool to send me an email when it detects something going wrong. I am using OSX and I followed the installation guide: http://www.snort.org/assets/188/Building_Snort_for_Mac_OS_X.pdf
In the .swatchrc file, I added these lines:
watchfor /Priority\: 1/i mail addresses=USERNAME\@DOMAIN,subject=[SNORT] Priority 1 Alert
I put swatch as a daemon:
sudo swatch --daemon -c /etc/swatch/.swatchrc -t /var/log/snort/alert
and finally wrote a plist file in order to launch swatch at boot time. The problem is tht I don't receive anything when I connect to my os with an ssh connection from an other device. Could someone help ?
(Here's the plist file
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http:// www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>net.sourceforge.swatch</string> <key>KeepAlive</key> <false/> <key>RunAtLoad</key> <true/> <key>ProgramArguments</key> <array> <string>/usr/local/bin/swatch</string> <string>--daemon</string> <string>-c</string> <string>/etc/swatch/.swatchrc</string> <string>-t</string> <string>/var/log/snort/alert</string> Page 16 of 17 </array> <key>ServiceDescription</key> <string>Swatch 3.2.3</string> </dict> </plist>)