Tag Info

New answers tagged

0

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances? So, how can you do it? you need to use a log parser. So ...


4

The Bad News Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together. The Good News Fear not, we can make it work. ...


0

Yes, there are many reason why you would want to have a complete audit trail of everything done on a given server (or everything you do on any server), and auditing is just a small fraction of it. Often information that later proves critical is only ever dumped to the console (not to any log file), and having a history to go look through can be very ...



Top 50 recent answers are included